From 7cd47fc5cfafa452cacb66ac450b057d24652522 Mon Sep 17 00:00:00 2001 From: Kevin Heis Date: Mon, 9 Feb 2026 10:16:38 -0800 Subject: [PATCH 1/4] Enable `no-explicit-any` eslint rule with legacy file exceptions (#59554) --- eslint.config.ts | 195 ++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 194 insertions(+), 1 deletion(-) diff --git a/eslint.config.ts b/eslint.config.ts index 37a3cd88d481..b1e162654557 100644 --- a/eslint.config.ts +++ b/eslint.config.ts @@ -99,7 +99,6 @@ export default [ // Disabled rules to review 'no-console': 'off', // 800+ - '@typescript-eslint/no-explicit-any': 'off', // Custom rules (disabled by default for now) 'custom-rules/use-custom-logger': 'off', @@ -187,6 +186,200 @@ export default [ }, }, + // Legacy files with @typescript-eslint/no-explicit-any violations (see github/docs-engineering#5797) + { + files: [ + 'src/article-api/liquid-renderers/rest-tags.ts', + 'src/article-api/scripts/generate-api-docs.ts', + 'src/article-api/transformers/audit-logs-transformer.ts', + 'src/article-api/transformers/rest-transformer.ts', + 'src/assets/scripts/validate-asset-images.ts', + 'src/automated-pipelines/tests/rendering.ts', + 'src/codeql-cli/scripts/convert-markdown-for-docs.ts', + 'src/content-linter/lib/helpers/get-lintable-yml.ts', + 'src/content-linter/lib/helpers/print-annotations.ts', + 'src/content-linter/lib/helpers/utils.ts', + 'src/content-linter/lib/init-test.ts', + 'src/content-linter/lib/linting-rules/code-annotations.ts', + 'src/content-linter/lib/linting-rules/index.ts', + 'src/content-linter/lib/linting-rules/internal-links-no-lang.ts', + 'src/content-linter/lib/linting-rules/journey-tracks-liquid.ts', + 'src/content-linter/lib/linting-rules/liquid-ifversion-versions.ts', + 'src/content-linter/lib/linting-rules/liquid-versioning.ts', + 'src/content-linter/lib/linting-rules/third-party-action-pinning.ts', + 'src/content-linter/scripts/lint-content.ts', + 'src/content-linter/scripts/pretty-print-results.ts', + 'src/content-linter/style/base.ts', + 'src/content-linter/tests/integration/lint-cli.ts', + 'src/content-linter/tests/learning-track-liquid.ts', + 'src/content-linter/tests/lint-files.ts', + 'src/content-linter/tests/lint-frontmatter-links.ts', + 'src/content-linter/tests/unit/table-column-integrity-simple.ts', + 'src/content-render/liquid/engine.ts', + 'src/content-render/liquid/ifversion.ts', + 'src/content-render/liquid/indented-data-reference.ts', + 'src/content-render/liquid/index.ts', + 'src/content-render/liquid/octicon.ts', + 'src/content-render/scripts/add-content-type.ts', + 'src/content-render/scripts/liquid-tags.ts', + 'src/content-render/scripts/move-by-content-type.ts', + 'src/content-render/scripts/move-content.ts', + 'src/content-render/tests/data.ts', + 'src/content-render/tests/link-error-line-numbers.ts', + 'src/content-render/unified/alerts.ts', + 'src/content-render/unified/annotate.ts', + 'src/content-render/unified/code-header.ts', + 'src/content-render/unified/copilot-prompt.ts', + 'src/content-render/unified/heading-links.ts', + 'src/content-render/unified/index.ts', + 'src/content-render/unified/module-types.d.ts', + 'src/content-render/unified/parse-info-string.ts', + 'src/content-render/unified/rewrite-empty-table-rows.ts', + 'src/content-render/unified/rewrite-for-rowheaders.ts', + 'src/content-render/unified/rewrite-local-links.ts', + 'src/content-render/unified/rewrite-table-captions.ts', + 'src/content-render/unified/rewrite-thead-th-scope.ts', + 'src/data-directory/lib/data-directory.ts', + 'src/data-directory/lib/data-schemas/features.ts', + 'src/data-directory/lib/data-schemas/learning-tracks.ts', + 'src/data-directory/lib/get-data.ts', + 'src/data-directory/scripts/find-orphaned-features/find.ts', + 'src/dev-toc/generate.ts', + 'src/early-access/scripts/migrate-early-access-product.ts', + 'src/early-access/scripts/what-docs-early-access-branch.ts', + 'src/events/components/events.ts', + 'src/events/components/experiments/experiment.ts', + 'src/events/lib/analyze-comment.ts', + 'src/events/lib/hydro.ts', + 'src/events/lib/middleware-errors.ts', + 'src/events/middleware.ts', + 'src/fixtures/tests/categories-and-subcategory.ts', + 'src/fixtures/tests/glossary.ts', + 'src/fixtures/tests/guides.ts', + 'src/fixtures/tests/homepage.ts', + 'src/fixtures/tests/liquid.ts', + 'src/fixtures/tests/markdown.ts', + 'src/fixtures/tests/translations.ts', + 'src/frame/components/context/ArticleContext.tsx', + 'src/frame/components/context/CategoryLandingContext.tsx', + 'src/frame/components/context/MainContext.tsx', + 'src/frame/components/context/TocLandingContext.tsx', + 'src/frame/components/hooks/useQueryParam.ts', + 'src/frame/components/ui/BumpLink/BumpLink.tsx', + 'src/frame/lib/create-tree.ts', + 'src/frame/lib/frontmatter.ts', + 'src/frame/lib/get-remote-json.ts', + 'src/frame/lib/page-data.ts', + 'src/frame/lib/page.ts', + 'src/frame/lib/read-file-contents.ts', + 'src/frame/lib/read-frontmatter.ts', + 'src/frame/lib/read-json-file.ts', + 'src/frame/middleware/find-page.ts', + 'src/frame/middleware/resolve-carousels.ts', + 'src/frame/middleware/set-fastly-surrogate-key.ts', + 'src/frame/tests/page.ts', + 'src/frame/tests/read-frontmatter.ts', + 'src/frame/tests/server.ts', + 'src/ghes-releases/scripts/deprecate/update-content.ts', + 'src/github-apps/lib/index.ts', + 'src/graphql/lib/index.ts', + 'src/graphql/pages/breaking-changes.tsx', + 'src/graphql/pages/changelog.tsx', + 'src/graphql/pages/reference.tsx', + 'src/graphql/pages/schema-previews.tsx', + 'src/graphql/scripts/build-changelog.ts', + 'src/graphql/scripts/utils/process-previews.ts', + 'src/graphql/scripts/utils/process-schemas.ts', + 'src/graphql/scripts/utils/schema-helpers.ts', + 'src/graphql/tests/validate-schema.ts', + 'src/journeys/lib/journey-path-resolver.ts', + 'src/journeys/middleware/journey-track.ts', + 'src/landings/components/CookBookFilter.tsx', + 'src/landings/components/ProductGuidesContext.tsx', + 'src/landings/components/ProductLandingContext.tsx', + 'src/landings/components/SidebarProduct.tsx', + 'src/landings/pages/home.tsx', + 'src/landings/pages/product.tsx', + 'src/landings/tests/octicons.test.ts', + 'src/languages/lib/correct-translation-content.ts', + 'src/languages/lib/get-alert-titles.ts', + 'src/languages/lib/render-with-fallback.ts', + 'src/languages/lib/translation-utils.ts', + 'src/learning-track/lib/process-learning-tracks.ts', + 'src/links/lib/update-internal-links.ts', + 'src/links/scripts/check-github-github-links.ts', + 'src/links/scripts/update-internal-links.ts', + 'src/links/tests/extract-links.ts', + 'src/observability/logger/index.ts', + 'src/observability/logger/lib/logger-context.ts', + 'src/observability/logger/lib/to-logfmt.ts', + 'src/observability/middleware/catch-middleware-error.ts', + 'src/observability/tests/logger.ts', + 'src/observability/tests/to-logfmt.test.ts', + 'src/pages/_error.tsx', + 'src/products/tests/get-product-groups.ts', + 'src/redirects/middleware/handle-redirects.ts', + 'src/rest/components/get-rest-code-samples.ts', + 'src/rest/lib/index.ts', + 'src/rest/pages/category.tsx', + 'src/rest/pages/subcategory.tsx', + 'src/rest/scripts/utils/create-rest-examples.ts', + 'src/rest/scripts/utils/get-operations.ts', + 'src/rest/scripts/utils/inject-models-schema.ts', + 'src/rest/scripts/utils/operation.ts', + 'src/rest/scripts/utils/sync.ts', + 'src/rest/scripts/utils/update-markdown.ts', + 'src/rest/tests/get-rest-code-samples-2.ts', + 'src/rest/tests/get-rest-code-samples.ts', + 'src/rest/tests/openapi-schema.ts', + 'src/rest/tests/rendering.ts', + 'src/search/components/hooks/useAISearchAutocomplete.ts', + 'src/search/components/hooks/useAISearchLocalStorageCache.ts', + 'src/search/components/input/AskAIResults.tsx', + 'src/search/components/input/SearchOverlay.tsx', + 'src/search/lib/get-elasticsearch-results/ai-search-autocomplete.ts', + 'src/search/lib/get-elasticsearch-results/general-search.ts', + 'src/search/lib/routes/combined-search-route.ts', + 'src/search/lib/search-request-params/get-search-from-request-params.ts', + 'src/search/lib/search-request-params/search-params-objects.ts', + 'src/search/lib/search-request-params/types.ts', + 'src/search/middleware/search-routes.ts', + 'src/search/scripts/index/index-cli.ts', + 'src/search/scripts/index/utils/indexing-elasticsearch-utils.ts', + 'src/search/scripts/scrape/lib/parse-page-sections-into-records.ts', + 'src/search/tests/topics.ts', + 'src/shielding/middleware/handle-invalid-query-string-values.ts', + 'src/shielding/middleware/handle-invalid-query-strings.ts', + 'src/tests/helpers/check-url.ts', + 'src/tests/helpers/e2etest.ts', + 'src/tests/scripts/copy-fixture-data.ts', + 'src/tests/vitest.setup.ts', + 'src/tools/components/Picker.tsx', + 'src/types/github__markdownlint-github.d.ts', + 'src/types/markdownlint-lib-rules.d.ts', + 'src/types/markdownlint-rule-helpers.d.ts', + 'src/types/markdownlint-rule-search-replace.d.ts', + 'src/types/primer__octicons.d.ts', + 'src/versions/scripts/update-versioning-in-files.ts', + 'src/versions/scripts/use-short-versions.ts', + 'src/versions/tests/get-applicable-versions.ts', + 'src/webhooks/lib/index.ts', + 'src/webhooks/scripts/webhook.ts', + 'src/workflows/content-changes-table-comment.ts', + 'src/workflows/enable-automerge.ts', + 'src/workflows/fr-add-docs-reviewers-requests.ts', + 'src/workflows/git-utils.ts', + 'src/workflows/issue-report.ts', + 'src/workflows/projects.ts', + 'src/workflows/tests/actions-workflows.ts', + 'src/workflows/unallowed-contributions.ts', + 'src/workflows/walk-files.ts', + ], + rules: { + '@typescript-eslint/no-explicit-any': 'off', + }, + }, + // Ignored patterns // CodeQL scripts included because cocofix is install manually by the workflow { From 0018750131bbaf777975194bac13ce076f9a88a9 Mon Sep 17 00:00:00 2001 From: Kevin Heis Date: Mon, 9 Feb 2026 10:25:16 -0800 Subject: [PATCH 2/4] Merge global fields from fields.json into audit log events (#59466) --- src/audit-logs/data/fpt/organization.json | 22197 +++++++++---- src/audit-logs/data/fpt/user.json | 12004 ++++--- src/audit-logs/data/ghec/enterprise.json | 26196 +++++++++++----- src/audit-logs/data/ghec/organization.json | 22197 +++++++++---- src/audit-logs/data/ghec/user.json | 12004 ++++--- src/audit-logs/data/ghes-3.14/enterprise.json | 20699 ++++++++---- .../data/ghes-3.14/organization.json | 19142 +++++++---- src/audit-logs/data/ghes-3.14/user.json | 10808 +++++-- src/audit-logs/data/ghes-3.15/enterprise.json | 21080 +++++++++---- .../data/ghes-3.15/organization.json | 19820 ++++++++---- src/audit-logs/data/ghes-3.15/user.json | 11131 +++++-- src/audit-logs/data/ghes-3.16/enterprise.json | 22533 +++++++++---- .../data/ghes-3.16/organization.json | 20511 ++++++++---- src/audit-logs/data/ghes-3.16/user.json | 11372 +++++-- src/audit-logs/data/ghes-3.17/enterprise.json | 23282 +++++++++----- .../data/ghes-3.17/organization.json | 20872 ++++++++---- src/audit-logs/data/ghes-3.17/user.json | 11464 +++++-- src/audit-logs/data/ghes-3.18/enterprise.json | 23245 +++++++++----- .../data/ghes-3.18/organization.json | 21317 +++++++++---- src/audit-logs/data/ghes-3.18/user.json | 11463 +++++-- src/audit-logs/data/ghes-3.19/enterprise.json | 24303 +++++++++----- .../data/ghes-3.19/organization.json | 22174 +++++++++---- src/audit-logs/data/ghes-3.19/user.json | 11848 ++++--- src/audit-logs/data/ghes-3.20/enterprise.json | 24303 +++++++++----- .../data/ghes-3.20/organization.json | 21956 +++++++++---- src/audit-logs/data/ghes-3.20/user.json | 11958 ++++--- src/audit-logs/lib/index.ts | 25 +- src/audit-logs/scripts/sync.ts | 18 + src/audit-logs/tests/unit/filter-events.ts | 93 + 29 files changed, 334114 insertions(+), 145901 deletions(-) diff --git a/src/audit-logs/data/fpt/organization.json b/src/audit-logs/data/fpt/organization.json index 87b056266bce..f08e99a42520 100644 --- a/src/audit-logs/data/fpt/organization.json +++ b/src/audit-logs/data/fpt/organization.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,29 +67,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -72,21 +103,32 @@ "description": "Credit was accepted for a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Editing a repository security advisory" }, @@ -95,21 +137,32 @@ "description": "Someone was added to the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -117,21 +170,32 @@ "description": "Credit was declined for a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -140,21 +204,32 @@ "description": "Someone was removed from the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -163,18 +238,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -182,17 +269,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -203,43 +301,66 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" - }, + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + }, { "action": "billing.budget_create", "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -255,22 +376,34 @@ "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "uuid", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -278,25 +411,37 @@ "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", - "request_access_security_header", "old_target_amount", "old_budget_limit_type", "old_alert_enabled", @@ -310,17 +455,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -329,19 +487,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -350,15 +520,28 @@ "description": "Azure subscription has been linked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -368,15 +551,28 @@ "description": "Azure subscription has been unlinked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -386,18 +582,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -405,16 +614,28 @@ "description": "The premium request paid usage policy for your GitHub account was changed.", "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -426,39 +647,62 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "operation_type", - "user_agent", - "created_at", - "user_id", - "request_id", - "actor", - "action", "@timestamp", "_document_id", - "programmatic_access_type" - ] - }, - { - "action": "checks.auto_trigger_disabled", - "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", - "fields": [ - "visibility", - "user_agent", - "user", - "@timestamp", - "repo", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "checks.auto_trigger_disabled", + "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -467,20 +711,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -491,17 +746,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -509,15 +776,31 @@ "description": "Existing code scanning alerts appeared in a branch.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -527,15 +810,31 @@ "description": "Code scanning alerts were fixed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -545,15 +844,31 @@ "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_numbers", "commit_oid", - "ref", - "request_id", - "org_id", - "org", - "business_id", - "business" + "ref" ], "docs_reference_titles": "About code scanning" }, @@ -562,15 +877,29 @@ "description": "Code scanning alerts were manually dismissed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers", "dismissal_approver_id" ], @@ -581,19 +910,31 @@ "description": "Dismissal of code scanning alerts was approved.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -604,19 +945,31 @@ "description": "Dismissal of code scanning alerts was denied.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "dismissal_request_id", - "alert_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", - "action", - "_document_id", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismissal_request_id", + "alert_number", + "public_repo", "created_at", "operation_type" ], @@ -627,19 +980,31 @@ "description": "Dismissal of code scanning alerts was requested.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -650,13 +1015,31 @@ "description": "Code scanning alerts were seen for the first time.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -666,15 +1049,31 @@ "description": "Code scanning alerts that were previously fixed reappeared.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -684,15 +1083,29 @@ "description": "Code scanning alerts that were previously dismissed were reopened.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -702,14 +1115,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -719,28 +1147,34 @@ "description": "An attempt to create a codespace from a prebuild was made.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "owner", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "user_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_id", + "user_agent", + "name", + "owner", + "pull_request_id", "created_at", "operation_type", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -748,17 +1182,30 @@ "description": "Enterprise setting for Codespaces ownership was updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enablement", "organization_names", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -769,25 +1216,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -798,22 +1254,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -825,22 +1292,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -849,15 +1327,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -868,15 +1361,28 @@ "description": "Policies were applied to codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -886,20 +1392,30 @@ "description": "Policies were removed from codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -907,19 +1423,30 @@ "description": "Policies were updated for codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -927,17 +1454,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -947,27 +1487,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "org", "owner", "pull_request_id", "machine_type", - "user_id", - "user", "devcontainer_path", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -975,19 +1524,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -995,18 +1557,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -1015,20 +1589,30 @@ "description": "A commit comment was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "repo", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "created_at", - "@timestamp", - "operation_type", + "programmatic_access_type", + "repo", "repo_id", - "actor_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", - "user_agent", - "action", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1036,21 +1620,30 @@ "description": "A commit comment was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "repo_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_id", - "action", - "@timestamp", - "repo", "org_id", - "actor_id", - "created_at", - "user_agent", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1058,21 +1651,33 @@ "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "reason", "plan", - "org_id", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1080,13 +1685,28 @@ "description": "Copilot feature settings were changed at the organization level.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1096,23 +1716,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -1120,16 +1747,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -1138,24 +1779,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -1163,15 +1810,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1181,20 +1841,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -1202,19 +1872,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -1222,21 +1904,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "business", - "business_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1244,21 +1935,33 @@ "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_value", "new_value", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1266,21 +1969,32 @@ "description": "The excluded paths for GitHub Copilot were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "excluded_paths", "owner_type", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1288,14 +2002,28 @@ "description": "Copilot custom instructions were created for the organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "action", - "_document_id", - "@timestamp", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "custom_instructions" @@ -1306,14 +2034,28 @@ "description": "Copilot custom instructions were updated for the organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "action", - "_document_id", - "@timestamp", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "custom_instructions" @@ -1324,17 +2066,30 @@ "description": "The plan for GitHub Copilot was updated.", "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_plan", "plan", - "business_id", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1346,20 +2101,31 @@ "description": "The plan for GitHub Copilot was scheduled to be downgraded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "current_plan", "scheduled_plan" @@ -1370,18 +2136,30 @@ "description": "MCP Configuration for Copilot coding agent was updated for a specific repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "new_config", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "new_config", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1391,22 +2169,33 @@ "description": "Specific repositories were disabled from using Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "owner_type", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1414,21 +2203,31 @@ "description": "Specific repositories were enabled to use Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "owner_type", - "owner", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1438,20 +2237,32 @@ "description": "Copilot coding agent access was updated for the organization's or user's repositories.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_access", "old_access", - "org_id", "owner_type", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1461,21 +2272,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1485,19 +2305,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1507,21 +2336,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1531,18 +2369,31 @@ "description": "A new custom property definition was created.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -1555,18 +2406,31 @@ "description": "A custom property definition was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -1580,14 +2444,29 @@ "description": "A custom property definition was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "value_type", @@ -1600,8 +2479,7 @@ "old_default_value", "old_value_type", "old_values_editable_by", - "values_editable_by", - "request_access_security_header" + "values_editable_by" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1610,27 +2488,35 @@ "description": "A repository's custom property value was manually set for the first time.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1639,19 +2525,31 @@ "description": "A repository's custom property value was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1660,16 +2558,29 @@ "description": "A repository's custom property value was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repository", - "repository_id", - "public_repo", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "public_repo", "created_at", "operation_type", "definition_id" @@ -1681,19 +2592,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1702,19 +2624,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1723,19 +2656,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1744,19 +2688,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1765,25 +2720,33 @@ "description": "Dismissal of Dependabot alerts was approved.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -1793,25 +2756,33 @@ "description": "Dismissal request for Dependabot alerts was canceled.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -1821,25 +2792,33 @@ "description": "Dismissal of Dependabot alerts was requested.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -1849,25 +2828,33 @@ "description": "Dismissal of Dependabot alerts was denied.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -1877,21 +2864,31 @@ "description": "The default repository access for Dependabot was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", "org", "org_id", - "access_level", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "access_level", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -1900,17 +2897,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1918,19 +2928,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1939,19 +2960,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1959,19 +2991,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1980,19 +3023,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2000,19 +3054,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -2021,19 +3086,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2041,19 +3117,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -2062,42 +3149,61 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "created_at", - "user", - "user_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", "_document_id", - "request_access_security_header" - ] - }, - { - "action": "discussion_comment.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "repo", - "org", - "repo_id", - "request_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "discussion_comment.destroy", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "@timestamp", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2105,20 +3211,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo_id", "@timestamp", - "actor", - "user_agent", - "request_id", - "org", "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "repo", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2126,22 +3242,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "user_agent", - "actor_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "title", - "_document_id", - "created_at", - "repo", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -2149,17 +3274,31 @@ "description": "A global announcement banner was created for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2170,16 +3309,30 @@ "description": "A global announcement banner was removed from the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2190,18 +3343,32 @@ "description": "A global announcement banner was updated for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", "old_message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2212,17 +3379,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was created.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", - "operation_type", "@timestamp", "_document_id", - "org_id", "action", - "request_id", - "org", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -2231,17 +3411,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was deleted.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", + "@timestamp", "_document_id", "action", - "@timestamp", - "actor_id", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -2250,46 +3443,65 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Managing environments for deployment" + }, + { + "action": "environment.create", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2297,28 +3509,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2327,27 +3545,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -2356,25 +3582,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2383,26 +3617,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2411,21 +3652,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -2434,22 +3687,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2458,25 +3721,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "public_repo", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "visibility", + "operation_type", + "created_at", + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2485,22 +3757,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -2509,21 +3793,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -2534,19 +3828,30 @@ "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2555,20 +3860,30 @@ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2577,19 +3892,30 @@ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2598,23 +3924,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2622,18 +3957,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -2644,20 +3989,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2667,25 +4022,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -2693,25 +4058,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -2719,26 +4093,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -2747,25 +4130,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -2773,26 +4165,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -2800,21 +4201,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -2823,19 +4235,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -2843,21 +4268,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -2866,19 +4302,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -2889,47 +4339,70 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", - "actor", - "created_at", "_document_id", - "repository_selection", - "integration", - "user_id", - "user", "action", - "operation_type", - "name", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "repository_selection", + "integration", + "operation_type", + "name", + "application_client_id" + ], + "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2940,23 +4413,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2967,21 +4452,33 @@ "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", "operation_type", - "@timestamp", "integration", - "action", - "user_agent", "reason", - "_document_id", - "org", - "org_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -2992,20 +4489,32 @@ "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ "@timestamp", - "actor_id", - "org", "_document_id", - "requester", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "requester", "created_at", "url", - "org_id", - "request_id", "operation_type", - "actor", "integration", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -3015,20 +4524,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -3038,19 +4560,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -3059,20 +4595,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -3082,20 +4631,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -3104,20 +4666,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -3126,20 +4701,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -3147,19 +4734,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -3168,19 +4768,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -3189,17 +4802,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -3212,21 +4838,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -3240,17 +4879,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -3262,19 +4914,30 @@ "description": "An IP allow list was disabled.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "actor", - "request_id", - "org", - "user_agent", + "@timestamp", "_document_id", - "user_id", + "action", + "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "@timestamp", - "user" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3282,19 +4945,30 @@ "description": "An IP allow list was disabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3302,20 +4976,29 @@ "description": "An IP allow list was enabled.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "business", - "user_id", - "request_id", - "actor", - "user", - "business_id", + "@timestamp", "_document_id", "action", - "@timestamp", - "user_agent", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ] }, @@ -3324,19 +5007,30 @@ "description": "An IP allow list was enabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3344,24 +5038,32 @@ "description": "An IP address was added to an IP allow list.", "docs_reference_links": "N/A", "fields": [ - "active", - "org", - "ip_allow_list_entry", "@timestamp", "_document_id", - "operation_type", - "created_at", - "user_agent", "action", - "request_id", + "actor", "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "business", - "actor", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", + "ip_allow_list_entry", + "operation_type", + "created_at" ] }, { @@ -3369,24 +5071,32 @@ "description": "An IP address was deleted from an IP allow list.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "ip_allow_list_entry", - "org", - "operation_type", - "created_at", - "active", "action", - "@timestamp", + "actor", + "actor_id", "business", "business_id", - "user_agent", + "hashed_token", + "org", "org_id", - "actor", - "actor_id", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ip_allow_list_entry", + "operation_type", + "created_at", + "active" ] }, { @@ -3394,19 +5104,32 @@ "description": "An IP address or its description was changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "actor_id", "ip_allow_list_entry", - "active", - "org_id", - "@timestamp" + "active" ] }, { @@ -3414,22 +5137,31 @@ "description": "A comment on an issue was deleted from the repository.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "org", - "repo", - "actor_id", "@timestamp", - "created_at", "_document_id", "action", - "operation_type", - "user_agent", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "oauth_application_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -3437,24 +5169,30 @@ "description": "A comment on an issue was pinned to a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3465,19 +5203,29 @@ "description": "A comment on an issue was unpinned from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3488,22 +5236,31 @@ "description": "A comment on an issue (other than the initial one) changed.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", - "action", - "repo_id", - "org_id", - "created_at", - "operation_type", "@timestamp", - "user_agent", - "request_id", "_document_id", - "actor_id", + "action", "actor", - "oauth_application_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -3511,20 +5268,30 @@ "description": "An issue was marked as blocked by another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", - "repo", - "repo_id", - "public_repo", - "org", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", + "public_repo", "created_at", "operation_type", "actor_is_bot" @@ -3535,19 +5302,30 @@ "description": "The blocked by relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3557,20 +5335,30 @@ "description": "An issue was marked as blocking another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3581,20 +5369,30 @@ "description": "The blocking relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3605,21 +5403,31 @@ "description": "An issue was deleted from the repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", "fields": [ - "user", - "actor_id", - "created_at", - "title", "@timestamp", "_document_id", - "request_id", - "actor", - "user_id", "action", - "operation_type", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "title", + "operation_type" ], "docs_reference_titles": "Deleting an issue" }, @@ -3628,23 +5436,33 @@ "description": "An issue was pinned to a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ + "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", "action", "actor", - "operation_type", - "owner_type", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "number", - "repo", - "event", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type", + "owner_type", + "number", + "event" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -3653,22 +5471,32 @@ "description": "An issue was transferred to another repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "owner_type", - "actor_id", "number", - "repo", "operation_type", - "_document_id", - "repo_id", - "action", - "request_id", - "created_at", - "actor", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Transferring an issue to another repository" }, @@ -3677,20 +5505,32 @@ "description": "An issue type was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issue_type_name", "description", "color", "enabled", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3701,20 +5541,32 @@ "description": "An issue type was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issue_type_name", "description", "color", "enabled", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3725,12 +5577,29 @@ "description": "An issue type was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "issue_type_name", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "issue_type_name", "description", "color", "enabled", @@ -3738,11 +5607,6 @@ "old_description", "old_color", "old_enabled", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3753,24 +5617,33 @@ "description": "An issue was unpinned from a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ - "event", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", - "action", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "operation_type", - "_document_id", - "number", - "owner_type", - "@timestamp", + "token_id", + "token_scopes", "user", "user_id", - "token_scopes", - "request_access_security_header" + "user_agent", + "event", + "created_at", + "operation_type", + "number", + "owner_type" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -3779,19 +5652,30 @@ "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user_agent", - "action", "@timestamp", - "operation_type", - "request_id", - "actor_id", - "user_id", - "created_at", "_document_id", + "action", "actor", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "org_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3800,18 +5684,29 @@ "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -3821,19 +5716,30 @@ "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user", - "request_id", - "actor", - "business_id", - "action", - "operation_type", - "user_agent", - "created_at", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor_id" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3842,18 +5748,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3861,21 +5779,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -3883,21 +5814,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -3905,22 +5849,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -3928,19 +5885,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "secondary_category", - "operation_type", - "marketplace_listing", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "secondary_category", + "operation_type", + "marketplace_listing", "primary_category", "integration" ] @@ -3950,22 +5920,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -3973,22 +5956,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -3996,20 +5992,30 @@ "description": "The ability for members to publish GitHub Pages sites was disabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4018,20 +6024,30 @@ "description": "The ability for members to publish GitHub Pages sites was enabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4040,21 +6056,30 @@ "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4063,22 +6088,30 @@ "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4087,21 +6120,30 @@ "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4110,22 +6152,30 @@ "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4134,39 +6184,61 @@ "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ + "@timestamp", "_document_id", - "request_id", - "user", - "user_id", - "business", - "operation_type", - "user_agent", + "action", "actor", "actor_id", + "business", "business_id", - "@timestamp", - "created_at", - "action" - ], - "docs_reference_titles": "Enforcing repository management policies in your enterprise" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, { "action": "members_can_delete_repos.disable", "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "request_id", - "org", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "actor", "operation_type", - "org_id", - "action", - "@timestamp", "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -4176,21 +6248,30 @@ "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "action", - "org_id", - "user_id", - "business", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business_id", + "user_id", + "user_agent", "created_at", - "actor", - "org", - "operation_type", - "user_agent" + "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -4201,16 +6282,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -4219,21 +6311,30 @@ "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "created_at", - "user_id", "business_id", - "user", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "org_id", - "@timestamp" + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -4242,19 +6343,30 @@ "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ - "request_id", - "created_at", - "_document_id", - "user_agent", - "user", - "user_id", - "business", - "business_id", - "operation_type", "@timestamp", + "_document_id", "action", "actor", - "actor_id" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -4263,19 +6375,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4283,21 +6407,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4307,16 +6440,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4326,18 +6472,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4347,14 +6506,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -4362,19 +6537,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -4382,18 +6568,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -4401,23 +6599,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -4425,16 +6631,30 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "org_id", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4442,24 +6662,32 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", - "repo_id", "operation_type", - "@timestamp", - "user_agent", "created_at", - "org", - "action", - "_document_id", - "repo", - "actor", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4467,15 +6695,28 @@ "description": "A network configuration for a hosted compute service was created.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -4493,15 +6734,28 @@ "description": "A network configuration for a hosted compute service was deleted.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -4514,15 +6768,28 @@ "description": "A network configuration for a hosted compute service was updated.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -4539,20 +6806,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4561,20 +6840,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4583,20 +6874,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4605,20 +6908,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4627,19 +6942,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4648,20 +6976,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4670,20 +7010,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4692,19 +7044,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4713,17 +7078,28 @@ "description": "An invitation sent to an organization to join an enterprise was accepted.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4734,41 +7110,61 @@ "description": "A billing manager was added to an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "org", - "user_id", "action", - "created_at", - "org_id", - "user", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" - ], - "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" - }, - { - "action": "org.add_disallowed_two_factor_method", - "description": "An organization prevented access to resources by users with the given two-factor method.", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" + }, + { + "action": "org.add_disallowed_two_factor_method", + "description": "An organization prevented access to resources by users with the given two-factor method.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "two_factor_method", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "two_factor_method", "created_at", "operation_type", "actor_is_bot" @@ -4779,21 +7175,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -4802,24 +7208,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4827,21 +7243,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -4849,20 +7275,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -4870,22 +7306,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -4893,20 +7337,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -4914,22 +7368,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -4937,43 +7399,64 @@ "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "new_policy", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "actor_is_bot" - ], - "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" - }, - { - "action": "org.advanced_security_policy_selected_member_disabled", - "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", - "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "new_policy", + "created_at", "operation_type", + "actor_is_bot" + ], + "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" + }, + { + "action": "org.advanced_security_policy_selected_member_disabled", + "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", - "business_id" + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -4982,19 +7465,30 @@ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -5004,15 +7498,28 @@ "description": "Third-party application access for outside collaborators was disabled for the organization.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5023,15 +7530,28 @@ "description": "Third-party application access for outside collaborators was enabled for the organization.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5042,15 +7562,28 @@ "description": "The organization was archived.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5060,17 +7593,30 @@ "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", "fields": [ - "org_id", - "operation_type", "@timestamp", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" }, @@ -5079,21 +7625,32 @@ "description": "An export of the organization's Git events was created.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "start", "end", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" }, @@ -5102,16 +7659,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_agent", - "action", "@timestamp", - "actor_id", - "org_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -5120,18 +7690,31 @@ "description": "An organization owner blocked a user from accessing the organization's repositories.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", "fields": [ - "actor", - "user_agent", - "org_id", - "created_at", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "blocked_user", + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" }, @@ -5140,19 +7723,30 @@ "description": "An invitation for an organization to join an enterprise was revoked", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "org", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "initiated_from" ], "docs_reference_titles": "Adding organizations to your enterprise" @@ -5162,22 +7756,33 @@ "description": "An invitation sent to a user to join an organization was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "email", - "@timestamp", - "actor", - "action", "operation_type", - "user_agent", - "org", "invitation_id", - "_document_id", "created_at", - "invitee_email", - "token_scopes", - "programmatic_access_type" + "invitee_email" ] }, { @@ -5185,19 +7790,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -5205,16 +7821,28 @@ "description": "Cleared two-factor authentication restrictions for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -5225,23 +7853,31 @@ "description": "Autofix for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5249,21 +7885,31 @@ "description": "Autofix for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5271,23 +7917,31 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5295,23 +7949,31 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5319,10 +7981,28 @@ "description": "Enablement for Code Security features on new repositories has been locked for this organization.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "action", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5332,10 +8012,28 @@ "description": "Enablement for Code Security features on new repositories has been unlocked for this organization.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "action", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5345,21 +8043,30 @@ "description": "Code scanning using the default setup was disabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -5368,21 +8075,30 @@ "description": "Code scanning using the default setup was enabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -5391,20 +8107,31 @@ "description": "Access to use Codespaces on internal and private repositories was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "enablement", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "enablement", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization" }, @@ -5413,21 +8140,31 @@ "description": "Ownership and payment for codespaces was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "owner_type", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" }, @@ -5436,16 +8173,29 @@ "description": "A team has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5455,16 +8205,29 @@ "description": "A team has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5474,19 +8237,30 @@ "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -5495,17 +8269,30 @@ "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -5514,21 +8301,30 @@ "description": "A user has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -5536,21 +8332,30 @@ "description": "A user has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -5558,16 +8363,29 @@ "description": "The interaction limit for collaborators only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "request_id", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" @@ -5577,17 +8395,30 @@ "description": "The interaction limit for prior contributors only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "operation_type", "@timestamp", - "created_at", - "user_agent", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", - "actor", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5596,17 +8427,30 @@ "description": "The interaction limit for existing users only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", "_document_id", - "operation_type", - "actor_id", - "org_id", "action", - "created_at", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5616,16 +8460,29 @@ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ "@timestamp", - "created_at", "_document_id", - "actor_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "action", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5634,17 +8491,30 @@ "description": "The interaction limit for prior contributors only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "operation_type", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5653,17 +8523,30 @@ "description": "The interaction limit for existing users only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "actor_id", - "request_id", + "@timestamp", + "_document_id", "action", - "created_at", - "user_agent", "actor", - "_document_id", - "org_id", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5672,22 +8555,30 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" }, @@ -5696,17 +8587,28 @@ "description": "An invitation for an organization to join an enterprise was confirmed.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5717,15 +8619,28 @@ "description": "Server statistics were exported for the organization.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5736,18 +8651,30 @@ "description": "An organization was created.", "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", "fields": [ - "request_id", - "org", - "actor_id", - "actor", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "org_id", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" }, @@ -5756,20 +8683,31 @@ "description": "A GitHub Actions secret was created for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5778,20 +8716,32 @@ "description": "A GitHub Actions variable was created for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5800,21 +8750,33 @@ "description": "A Codespaces or Dependabot secret was created for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -5822,21 +8784,30 @@ "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor_id", - "org_id", - "business", - "action", "@timestamp", - "org", "_document_id", - "business_id", + "action", "actor", - "token_scopes", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "actor_is_bot", "oauth_credential_type", "managed_oauth_access_id", @@ -5852,24 +8823,32 @@ "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", "fields": [ - "user_agent", - "actor", "@timestamp", - "created_at", - "org_id", - "business_id", - "operation_type", - "request_id", "_document_id", "action", + "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", - "token_scopes", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot", "oauth_credential_type", - "request_access_security_header", "managed_oauth_access_id", "managed_token_id", "managed_oauth_scopes", @@ -5883,21 +8862,32 @@ "description": "An owner revoked authorized credentials.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "oauth_application_id", - "org_id", "operation_type", - "action", - "business", - "request_id", "created_at", - "business_id", - "actor_id", - "_document_id", - "user_agent", "oauth_credential_type", "managed_oauth_access_id", "managed_token_id", @@ -5912,18 +8902,30 @@ "description": "An organization was deleted by a user or staff.", "docs_reference_links": "N/A", "fields": [ - "user_agent", "@timestamp", "_document_id", - "created_at", - "actor", - "org_id", - "org", "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5931,20 +8933,30 @@ "description": "Team creation was limited to owners.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "actor", "@timestamp", "_document_id", - "user", - "user_id", "action", - "created_at", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -5953,16 +8965,29 @@ "description": "Third-party application access restrictions for an organization were disabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "org_id", - "action", - "_document_id", - "request_id", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" @@ -5972,19 +8997,30 @@ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -5993,14 +9029,31 @@ "description": "SAML single sign-on was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sso_url", "issuer", - "action", - "@timestamp", - "_document_id", "created_at", - "org", "operation_type" ] }, @@ -6009,21 +9062,30 @@ "description": "Display of IP addresses within audit log events for the organization was disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" }, @@ -6032,17 +9094,30 @@ "description": "A two-factor authentication requirement was disabled for the organization.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "org_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "_document_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6050,19 +9125,30 @@ "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "user", - "action", - "operation_type", "@timestamp", "_document_id", - "created_at", - "user_agent", - "org", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6070,19 +9156,30 @@ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "user", - "action", - "actor_id", - "org_id" + "created_at" ] }, { @@ -6090,19 +9187,30 @@ "description": "Team creation by members was allowed.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "org_id", - "user", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -6111,17 +9219,30 @@ "description": "Third-party application access restrictions for an organization were enabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "operation_type", - "org", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" }, @@ -6130,19 +9251,30 @@ "description": "An organization owner allowed users with read access to create discussions in an organization", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -6151,19 +9283,32 @@ "description": "SAML single sign-on was enabled for the organization.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", - "sso_url", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "@timestamp", - "issuer", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "sso_url", + "created_at", + "issuer" ], "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" }, @@ -6172,21 +9317,30 @@ "description": "Display of IP addresses within audit log events for the organization was enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "business", - "business_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" }, @@ -6195,17 +9349,30 @@ "description": "Two-factor authentication is now required for the organization.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "actor_id", - "action", - "_document_id", - "org", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" }, @@ -6214,17 +9381,30 @@ "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "org_id", - "manager", "@timestamp", - "request_id", - "actor", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "manager", + "operation_type", "created_at" ] }, @@ -6233,18 +9413,31 @@ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", "docs_reference_links": "N/A", "fields": [ - "org_id", "@timestamp", - "org", - "user_agent", - "request_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "manager", "operation_type", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6252,23 +9445,32 @@ "description": "A new user was invited to join an organization.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", "fields": [ - "org", - "user_id", - "invitation_id", - "org_id", - "user", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", - "created_at", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "invitee_email", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitation_id", + "operation_type", + "created_at", + "invitee_email" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" }, @@ -6277,17 +9479,28 @@ "description": "An organization was invited to join an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -6297,19 +9510,30 @@ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6317,19 +9541,30 @@ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "org", - "org_id", - "user_agent", - "actor_id", - "user_id", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6337,19 +9572,31 @@ "description": "Access to an organization was granted for an OAuth App.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "request_id", "actor_id", - "operation_type", - "org_id", - "_document_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" @@ -6359,20 +9606,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -6381,18 +9639,31 @@ "description": "Access was disabled for an OAuth App that was previously approved.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", "fields": [ - "request_id", - "url", - "created_at", - "org_id", - "action", "@timestamp", "_document_id", - "user_agent", - "org", - "operation_type", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", + "operation_type", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" @@ -6402,19 +9673,31 @@ "description": "An organization member requested that an owner grant an OAuth App access to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", + "@timestamp", "_document_id", - "request_id", - "url", - "org_id", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "url", "oauth_application_name" ] }, @@ -6423,20 +9706,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -6446,16 +9740,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "org_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type", - "_document_id", - "org" + "created_at", + "operation_type" ] }, { @@ -6463,20 +9770,31 @@ "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "reason", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "reason", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -6485,20 +9803,30 @@ "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -6507,19 +9835,30 @@ "description": "An organization owner downloaded the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6528,19 +9867,30 @@ "description": "An organization owner generated the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6549,19 +9899,30 @@ "description": "An organization owner printed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6570,19 +9931,30 @@ "description": "An organization owner viewed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "business", - "business_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6591,19 +9963,31 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", "fields": [ - "actor", - "operation_type", "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "actor_is_bot", - "request_access_security_header" + "operation_type", + "created_at", + "actor_is_bot" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -6612,20 +9996,31 @@ "description": "A GitHub Actions secret was removed from an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -6634,21 +10029,31 @@ "description": "A GitHub Actions variable was removed from an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -6657,18 +10062,29 @@ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "user_id", - "user_agent", - "org_id", - "user", - "action", - "_document_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" @@ -6678,19 +10094,29 @@ "description": "Removed a two-factor authentication method restriction for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "two_factor_method", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "two_factor_method", "created_at", "operation_type", "actor_is_bot" @@ -6701,22 +10127,32 @@ "description": "A Codespaces or Dependabot secret was removed from an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -6724,21 +10160,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6746,21 +10191,30 @@ "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ - "org", - "user", - "org_id", - "created_at", - "request_id", "@timestamp", - "action", - "operation_type", - "user_agent", "_document_id", + "action", "actor", "actor_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6768,40 +10222,62 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", - "org", - "team", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "programmatic_access_type" - ] - }, - { - "action": "org.remove_self_hosted_runner", - "description": "A self-hosted runner was removed.", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type" + ] + }, + { + "action": "org.remove_self_hosted_runner", + "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", "fields": [ - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "actor", - "action", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -6810,19 +10286,31 @@ "description": "An organization was renamed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "_document_id", "@timestamp", - "org", + "_document_id", "action", "actor", - "old_login", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_login", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -6830,14 +10318,28 @@ "description": "Triggered when a required workflow is created.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6848,14 +10350,28 @@ "description": "Triggered when a required workflow is deleted.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6866,14 +10382,28 @@ "description": "Triggered when a required workflow is updated.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6884,20 +10414,30 @@ "description": "An organization member was restored.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", "fields": [ - "user", - "actor", - "user_id", + "@timestamp", "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "actor_id", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" }, @@ -6906,18 +10446,29 @@ "description": "A member's linked identity was revoked.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", "user_id", - "@timestamp", - "action", - "actor_id", "user_agent", - "_document_id", - "request_id", + "operation_type", "created_at" ], "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" @@ -6927,19 +10478,30 @@ "description": "A member's SAML session was revoked.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", "fields": [ - "actor_id", - "created_at", - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" }, @@ -6948,21 +10510,33 @@ "description": "A self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" @@ -6972,21 +10546,31 @@ "description": "A self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "business", "business_id", - "programmatic_access_type" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6995,20 +10579,31 @@ "description": "A self-hosted runner group was renamed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7017,23 +10612,33 @@ "description": "The REST API was used to remove a self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -7042,23 +10647,31 @@ "description": "A self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7067,19 +10680,32 @@ "description": "A runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -7088,25 +10714,36 @@ "description": "The configuration of a self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7115,21 +10752,32 @@ "description": "The visibility of a self-hosted runner group was updated via the REST API.", "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", - "visibility", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" }, @@ -7138,10 +10786,28 @@ "description": "Enablement for Secret Protection features on new repositories has been locked for this organization.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "action", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7151,10 +10817,28 @@ "description": "Enablement for Secret Protection features on new repositories has been unlocked for this organization.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "action", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7164,21 +10848,30 @@ "description": "Automatic partner validation checks have been disabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -7188,21 +10881,30 @@ "description": "Automatic partner validation checks have been enabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -7212,20 +10914,30 @@ "description": "A custom pattern was created for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7234,22 +10946,30 @@ "description": "A custom pattern was removed from secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7258,21 +10978,30 @@ "description": "A custom pattern was published for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7281,21 +11010,30 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7304,22 +11042,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7328,21 +11074,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7351,22 +11106,30 @@ "description": "Generic secrets have been disabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -7374,22 +11137,30 @@ "description": "Generic secrets have been enabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -7397,21 +11168,30 @@ "description": "Secret scanning for non-provider patterns was disabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7421,21 +11201,30 @@ "description": "Secret scanning for non-provider patterns was enabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7445,19 +11234,30 @@ "description": "A role or team was added to the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7467,21 +11267,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7491,21 +11300,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7515,19 +11333,30 @@ "description": "A role or team was removed from the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7537,22 +11366,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7561,22 +11398,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7585,22 +11430,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7609,21 +11462,30 @@ "description": "Push protection for secret scanning was disabled.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7632,21 +11494,30 @@ "description": "Push protection for secret scanning was enabled.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7655,22 +11526,30 @@ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7679,22 +11558,30 @@ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7703,12 +11590,28 @@ "description": "The push protection setting was updated for a secret type for your organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "push_protection_setting", "secret_type", "secret_type_display_name", @@ -7721,12 +11624,28 @@ "description": "The push protection pattern configuration was updated for your organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at" ], "docs_reference_titles": "About push protection" @@ -7736,26 +11655,35 @@ "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -7764,26 +11692,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7791,28 +11727,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7820,26 +11764,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7847,32 +11799,66 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", - "org", - "runner_id", - "runner_name", - "action", + "@timestamp", "_document_id", - "operation_type", - "created_at", - "@timestamp" - ], - "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" - }, - { + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_id", + "runner_name", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" + }, + { "action": "org.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -7881,7 +11867,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -7896,18 +11903,28 @@ "description": "The cache retention policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -7919,18 +11936,28 @@ "description": "The cache storage policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -7942,20 +11969,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -7964,16 +12002,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -7984,18 +12035,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -8004,17 +12068,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", "_document_id", - "org_id", - "operation_type", + "action", "actor", "actor_id", - "@timestamp", - "request_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", - "action" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8022,18 +12099,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -8042,18 +12131,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -8062,18 +12164,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -8082,22 +12196,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", "actor_id", - "org_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issuer", - "business", "operation_type", "created_at", - "request_id", - "business_id", - "_document_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8105,21 +12229,32 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Adding organizations to your enterprise" }, @@ -8128,19 +12263,30 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8151,15 +12297,28 @@ "description": "The organization was unarchived.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -8169,19 +12328,32 @@ "description": "A user was unblocked from an organization.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", "fields": [ - "oauth_application_id", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", - "@timestamp", - "request_id", - "created_at", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "blocked_user", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" }, @@ -8190,20 +12362,32 @@ "description": "A GitHub Actions secret was updated for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "created_at", "key", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -8212,23 +12396,34 @@ "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "updated_allowed_types", "old_policy", - "updated_access_policy", - "programmatic_access_type", - "request_access_security_header" + "updated_access_policy" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" }, @@ -8237,20 +12432,32 @@ "description": "A GitHub Actions variable was updated for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -8259,20 +12466,32 @@ "description": "The default repository permission level for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", + "created_at", "permission", - "actor_id", - "old_permission", - "_document_id", - "programmatic_access_type" + "old_permission" ] }, { @@ -8280,18 +12499,30 @@ "description": "The settings policy for immutable releases was updated for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_policy", "new_policy", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8302,22 +12533,33 @@ "description": "A Codespaces or Dependabot secret was updated for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -8326,20 +12568,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -8347,17 +12600,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -8367,20 +12633,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -8389,17 +12666,30 @@ "description": "The name of the default branch was changed for new repositories in the organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" }, @@ -8408,17 +12698,30 @@ "description": "The repository self-hosted runners policy was updated", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_repo_runners_policy", "new_repo_runners_policy", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8429,19 +12732,32 @@ "description": "An organization's SAML provider settings were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "sso_url", - "actor_id", - "operation_type", "@timestamp", - "issuer", - "org", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "operation_type", + "issuer", + "created_at" ] }, { @@ -8449,18 +12765,30 @@ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", "fields": [ - "request_id", - "org_id", - "actor", - "actor_id", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "org", "action", - "@timestamp", - "created_at", - "request_access_security_header" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" }, @@ -8469,21 +12797,31 @@ "description": "An organization's custom property value was manually set for the first time.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8495,21 +12833,31 @@ "description": "An organization's custom property value was deleted.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8521,18 +12869,30 @@ "description": "A default label was created for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", "fields": [ - "request_id", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", - "_document_id", - "action", - "created_at", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" }, @@ -8541,17 +12901,30 @@ "description": "A default label was deleted for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", "fields": [ - "operation_type", - "request_id", - "actor", "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" }, @@ -8560,17 +12933,30 @@ "description": "A default label was edited for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", "fields": [ - "org", - "created_at", "@timestamp", - "actor", + "_document_id", "action", - "user_agent", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" }, @@ -8579,20 +12965,33 @@ "description": "A domain was approved for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "org_id", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" }, @@ -8601,16 +13000,31 @@ "description": "A domain was added to an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "created_at", + "@timestamp", "_document_id", - "domain_name", "action", - "request_id", + "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "domain_name", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8619,14 +13033,29 @@ "description": "A domain was removed from an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", "fields": [ - "action", - "domain_name", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "domain_name", "operation_type", "created_at" ], @@ -8637,34 +13066,62 @@ "description": "A domain was verified for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "operation_type", - "domain_name", "@timestamp", - "user_agent", - "request_id", - "actor", - "action", - "created_at", "_document_id", - "actor_id" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" - }, - { - "action": "organization_moderators.add_team", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "domain_name", + "created_at" + ], + "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + }, + { + "action": "organization_moderators.add_team", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -8674,17 +13131,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -8694,16 +13162,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -8713,20 +13194,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -8734,19 +13225,30 @@ "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor", - "business_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", "user_agent", - "_document_id", "created_at", - "operation_type", - "request_id", - "business" + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -8755,19 +13257,30 @@ "description": "Organization projects were disabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "operation_type", - "@timestamp", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -8776,18 +13289,29 @@ "description": "Organization projects were enabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor_id", - "org_id", - "created_at", - "user_id", - "org", "@timestamp", "_document_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", + "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" @@ -8797,23 +13321,33 @@ "description": "An organization role was assigned to a user or team.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About custom organization roles" }, @@ -8822,25 +13356,32 @@ "description": "A custom organization role was created in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8852,25 +13393,32 @@ "description": "A custom organization role was deleted in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8881,19 +13429,30 @@ "description": "A user or team was unassigned an organization role.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type" ], @@ -8904,26 +13463,33 @@ "description": "A custom organization role was edited in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", "old_role_permissions", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -8936,22 +13502,33 @@ "description": "An organization's default project base role was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_project_base_role", - "new_project_base_role", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_project_base_role", + "new_project_base_role", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8959,20 +13536,31 @@ "description": "An entire package was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" @@ -8982,23 +13570,34 @@ "description": "A package was published or republished to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "ecosystem", "version_count", "is_republished", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -9007,21 +13606,32 @@ "description": "A specific package version was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "version", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "ecosystem", "actor_is_bot" ], @@ -9032,21 +13642,34 @@ "description": "A specific package version was published or republished to a package.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "ecosystem", "package", "version", - "actor_id", - "user_agent", "is_republished", - "actor", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -9055,20 +13678,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -9077,41 +13714,70 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", - "owner_type", - "domain", - "state", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" - }, - { - "action": "pages_protected_domain.verify", - "description": "A GitHub Pages domain was verified for an organization or enterprise.", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", + "owner_type", + "domain", + "state", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + }, + { + "action": "pages_protected_domain.verify", + "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -9120,18 +13786,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9139,16 +13817,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -9156,18 +13848,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -9175,18 +13879,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9197,22 +13914,31 @@ "description": "The configured restriction for access to resources via personal access tokens was disabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9220,22 +13946,31 @@ "description": "The configured restriction for access to resources via personal access tokens was enabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9243,18 +13978,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9265,19 +14013,29 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", "actor_is_bot" ] @@ -9287,18 +14045,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9309,23 +14077,34 @@ "description": "A personal access token expiration limit was set.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "token_expiration", "old_token_expiration", "exempt_administrators", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9333,21 +14112,32 @@ "description": "A personal access token expiration limit was unset.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "programmatic_access_type", - "old_token_expiration", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_token_expiration", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9355,17 +14145,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9376,18 +14179,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9399,17 +14215,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9421,20 +14250,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was created.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9446,20 +14284,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9471,20 +14318,29 @@ "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9496,20 +14352,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9521,15 +14386,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9539,17 +14419,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -9559,15 +14450,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9577,19 +14483,30 @@ "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "action", - "operation_type", "@timestamp", - "business_id", + "_document_id", + "action", + "actor", "actor_id", - "user", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9597,23 +14514,30 @@ "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "created_at", - "actor_id", + "@timestamp", "_document_id", - "actor", - "user", - "repo", "action", - "user_agent", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "request_id", - "user_id", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -9621,23 +14545,30 @@ "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_id", - "operation_type", + "@timestamp", "_document_id", "action", - "@timestamp", - "repo", - "org", - "business", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org_id", - "created_at", - "business_id" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9645,17 +14576,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9665,17 +14607,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9685,17 +14638,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9705,17 +14669,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -9725,17 +14700,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -9745,17 +14733,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9763,25 +14764,36 @@ "description": "A project's base role was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_project_base_role", "new_project_base_role", "project_number", "public_project", - "business", "project_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9789,20 +14801,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -9812,25 +14835,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -9838,20 +14873,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9859,25 +14906,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9885,17 +14944,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -9903,17 +14975,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -9921,18 +15006,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -9941,18 +15038,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -9961,19 +15070,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -9981,17 +15101,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -10003,22 +15136,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -10026,19 +15168,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -10046,17 +15199,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -10064,18 +15230,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -10083,20 +15262,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -10104,18 +15293,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -10124,18 +15325,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -10144,16 +15357,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -10165,21 +15391,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -10187,22 +15425,32 @@ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", "fields": [ - "repo", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "name", "created_at", - "_document_id", "operation_type", - "actor", - "repo_id", - "org", - "request_id", - "actor_id", - "oauth_application_id", - "@timestamp", - "programmatic_access_type" + "oauth_application_id" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" }, @@ -10211,29 +15459,34 @@ "description": "A protected branch allowance was given to a specific user, team or integration.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "authorized_actors", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -10241,24 +15494,32 @@ "description": "Branch protection was enabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "repo_id", - "user_id", "@timestamp", - "user_agent", - "repo", - "name", - "org_id", - "user", "_document_id", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", "created_at", "authorized_actor_names", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -10269,21 +15530,31 @@ "description": "Branch protection was disabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "repo", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", - "request_id", - "repo_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "name", + "operation_type", "created_at", - "_document_id", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -10294,22 +15565,32 @@ "description": "Enforcement of dismissing stale pull requests was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "dismiss_stale_reviews_on_push", - "org_id", - "action", - "created_at", - "request_id", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismiss_stale_reviews_on_push", + "created_at", "operation_type", - "actor", - "repo", - "org", - "name", - "programmatic_access_type" + "name" ] }, { @@ -10317,24 +15598,34 @@ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "actor", - "oauth_application_id", - "authorized_actors_only", - "authorized_actors", - "created_at", - "user_agent", - "name", + "@timestamp", "_document_id", - "org_id", - "request_id", - "@timestamp", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "operation_type", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "authorized_actors_only", + "authorized_actors", + "created_at", + "name", + "operation_type" ] }, { @@ -10342,30 +15633,37 @@ "description": "A branch protection requirement was overridden by a repository administrator.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "actor", "reasons", - "@timestamp", "before", "after", - "actor_id", - "repo", "operation_type", - "user_agent", "branch", "overridden_codes", - "org", - "org_id", - "action", - "_document_id", - "request_id", "referrer", - "business", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "rule_suite_id" ] @@ -10375,28 +15673,36 @@ "description": "A branch update attempt was rejected.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "request_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "branch", "before", "overridden_codes", "after", - "action", "reasons", - "actor_id", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "actor_is_bot", "rule_suite_id" @@ -10407,23 +15713,32 @@ "description": "Branch protection was enforced for repository administrators.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "admin_enforced", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "name", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "action", "repo_id", - "org_id", - "_document_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "admin_enforced", + "operation_type", + "name", + "created_at" ] }, { @@ -10431,22 +15746,32 @@ "description": "Branch deletion was enabled or disabled for a protected branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "operation_type", - "request_id", - "repo", "@timestamp", - "org_id", - "org", - "action", - "allow_deletions_enforcement_level", "_document_id", - "created_at", - "actor_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_deletions_enforcement_level", + "created_at" ] }, { @@ -10454,23 +15779,32 @@ "description": "Force pushes were enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "actor_id", - "name", + "@timestamp", "_document_id", + "action", "actor", - "repo", - "operation_type", - "request_id", - "allow_force_pushes_enforcement_level", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_force_pushes_enforcement_level", + "created_at" ] }, { @@ -10478,24 +15812,33 @@ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "ignore_approvals_from_contributors", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -10504,22 +15847,32 @@ "description": "Required linear commit history was enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "operation_type", "actor", - "linear_history_requirement_enforcement_level", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "linear_history_requirement_enforcement_level", "name", - "org_id", - "repo_id", - "org", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ] }, { @@ -10527,24 +15880,33 @@ "description": "Fork syncing was enabled or disabled for a read-only branch", "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "lock_allows_fetch_and_merge", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -10553,27 +15915,34 @@ "description": "The enforcement of a branch lock was updated.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "enforcement_level", "lock_branch_enforcement_level", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -10582,18 +15951,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -10604,24 +15986,33 @@ "description": "A branch name pattern was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "old_name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "old_name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -10629,25 +16020,32 @@ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", "docs_reference_links": "N/A", "fields": [ - "name", - "org_id", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "@timestamp", + "business", "business_id", - "request_id", - "pull_request_reviews_enforcement_level", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "business", - "user_agent", - "created_at", "repo_id", - "operation_type", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "pull_request_reviews_enforcement_level", + "created_at", + "operation_type" ] }, { @@ -10655,22 +16053,32 @@ "description": "Enforcement of required code owner review was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "created_at", - "require_code_owner_review", - "operation_type", - "name", - "user_agent", - "action", "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "request_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "require_code_owner_review", + "operation_type", + "name" ] }, { @@ -10678,22 +16086,33 @@ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "require_last_push_approval", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" }, @@ -10702,22 +16121,32 @@ "description": "Enforcement of the required number of approvals before merging was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "required_approving_review_count", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "required_approving_review_count", "created_at", - "actor", "operation_type", - "user_agent", - "name", - "org_id", - "action", - "actor_id", - "_document_id", - "org", - "@timestamp", - "programmatic_access_type" + "name" ] }, { @@ -10725,25 +16154,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "user_agent", "@timestamp", "_document_id", - "name", - "repo", "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "business", - "actor_id", - "operation_type", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "required_status_checks_enforcement_level", - "org", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "required_status_checks_enforcement_level" ] }, { @@ -10751,22 +16187,32 @@ "description": "Enforcement of required commit signing was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "name", "@timestamp", - "created_at", "_document_id", - "request_id", - "repo_id", - "org", - "org_id", "action", "actor", "actor_id", - "signature_requirement_enforcement_level", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "programmatic_access_type" + "operation_type", + "name", + "created_at", + "signature_requirement_enforcement_level" ] }, { @@ -10774,22 +16220,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "created_at", - "repo_id", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "name", - "actor", - "repo", "operation_type", - "action", - "strict_required_status_checks_policy", - "programmatic_access_type" + "strict_required_status_checks_policy" ] }, { @@ -10797,23 +16253,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -10822,24 +16289,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -10848,20 +16326,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10870,21 +16362,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -10894,22 +16399,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10918,25 +16435,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10945,23 +16472,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", - "created_at", - "key", - "fingerprint", - "actor_id", "actor", - "title", - "user_agent", - "user_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "read_only", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "key", + "fingerprint", + "title", + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10970,18 +16508,32 @@ "description": "A pull request was closed without being merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" @@ -10991,21 +16543,32 @@ "description": "A pull request was converted to a draft.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" }, @@ -11014,19 +16577,32 @@ "description": "A pull request was created.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -11037,23 +16613,35 @@ "description": "A review was requested on a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -11063,17 +16651,31 @@ "description": "A pull request was marked as in progress.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11081,19 +16683,32 @@ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -11101,19 +16716,32 @@ "description": "A pull request was merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" @@ -11123,21 +16751,32 @@ "description": "A pull request was marked as ready for review.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" }, @@ -11146,27 +16785,34 @@ "description": "A pull request was rebased.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", - "pull_request_url", - "pull_request_title", - "user", - "user_id", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", + "pull_request_url", + "pull_request_title", + "public_repo", + "created_at", + "operation_type" ] }, { @@ -11174,23 +16820,35 @@ "description": "A review request was removed from a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" }, @@ -11199,18 +16857,32 @@ "description": "A pull request was reopened after previously being closed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -11218,19 +16890,31 @@ "description": "A review comment was added to a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "comment_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -11240,20 +16924,31 @@ "description": "A review comment on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", "@timestamp", "_document_id", - "repo", - "created_at", - "request_id", - "comment_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "comment_id", + "operation_type" ] }, { @@ -11261,18 +16956,31 @@ "description": "A review comment on a pull request was changed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "request_id", - "actor_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "_document_id", - "@timestamp", - "comment_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "comment_id" ] }, { @@ -11280,21 +16988,33 @@ "description": "A review on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ] }, { @@ -11302,20 +17022,33 @@ "description": "A review on a pull request was dismissed.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" }, @@ -11324,19 +17057,33 @@ "description": "A review on a pull request was submitted.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" @@ -11346,45 +17093,64 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", - "actor_id", - "user_id", - "created_at", - "user_agent", - "actor", - "action", - "repo", - "visibility", "_document_id", - "previous_visibility", - "programmatic_access_type" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" - }, - { + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility", + "previous_visibility" + ], + "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + }, + { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -11393,25 +17159,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -11420,23 +17193,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -11445,24 +17226,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -11471,23 +17259,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -11497,22 +17293,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -11521,19 +17326,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -11542,24 +17360,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -11568,24 +17396,32 @@ "description": "Autofix for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", - "public_repo", - "org", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "public_repo", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11593,24 +17429,32 @@ "description": "Autofix for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11618,24 +17462,32 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11643,24 +17495,32 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11668,23 +17528,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -11695,17 +17564,29 @@ "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -11715,17 +17596,29 @@ "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -11735,25 +17628,31 @@ "description": "Code scanning using the default setup was disabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -11762,26 +17661,34 @@ "description": "Code scanning using the default setup was enabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "query_suite", "threat_model", - "languages", - "request_access_security_header" + "languages" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -11790,25 +17697,34 @@ "description": "Code scanning using the default setup was updated for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "query_suite", - "threat_model", - "languages", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "query_suite", + "threat_model", + "languages", + "public_repo", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Configuring default setup for code scanning" @@ -11818,19 +17734,30 @@ "description": "GitHub Codespaces was granted trusted repository access to this repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -11839,19 +17766,30 @@ "description": "GitHub Codespaces trusted repository access to this repository was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11859,17 +17797,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11878,15 +17829,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -11897,16 +17861,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11916,17 +17893,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11936,19 +17926,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11957,17 +17958,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11976,27 +17990,33 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "public_repo", + "created_at", + "operation_type" + ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, { @@ -12004,30 +18024,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -12037,20 +18062,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12059,25 +18095,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12086,23 +18130,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -12110,25 +18165,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -12138,23 +18202,32 @@ "description": "A source code archive of a repository was downloaded as a ZIP file.", "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "created_at", "operation_type", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" @@ -12164,24 +18237,32 @@ "description": "The setting for immutable releases was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -12190,20 +18271,30 @@ "description": "The setting for immutable releases was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -12214,23 +18305,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -12238,21 +18339,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -12260,21 +18371,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -12282,22 +18403,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -12305,21 +18435,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -12327,20 +18467,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -12348,22 +18499,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -12371,18 +18531,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -12390,22 +18564,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -12413,21 +18597,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -12435,18 +18629,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -12455,22 +18661,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12479,24 +18694,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12505,23 +18728,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -12529,26 +18762,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -12557,21 +18795,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -12580,25 +18827,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -12606,22 +18859,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -12630,25 +18893,34 @@ "description": "A branch was renamed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "old_branch", - "new_branch", - "default_branch", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "old_branch", + "new_branch", + "default_branch", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch" @@ -12658,19 +18930,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -12678,17 +18961,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -12697,17 +18995,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -12716,7 +19029,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -12731,22 +19065,30 @@ "description": "The cache retention policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -12758,22 +19100,30 @@ "description": "The cache storage policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -12785,23 +19135,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -12811,20 +19170,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -12835,21 +19205,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -12858,22 +19239,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -12882,21 +19273,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -12905,22 +19307,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -12931,16 +19343,27 @@ "fields": [ "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", "created_at", - "actor", - "repo_id", - "action", - "org", - "org_id", - "request_id", - "repo", "operation_type" ] }, @@ -12950,22 +19373,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -12974,23 +19408,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -13000,19 +19444,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -13020,21 +19474,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -13043,24 +19507,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -13068,25 +19541,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -13095,24 +19575,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13121,25 +19611,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -13148,22 +19646,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13172,26 +19679,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -13199,31 +19714,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13232,22 +19754,30 @@ "description": "Someone closed a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", "fields": [ - "actor", - "repo", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "user_agent", - "actor_id", - "request_id", - "action", - "operation_type", - "created_at", - "repo_id", - "_document_id", + "hashed_token", "org", "org_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "About repository security advisories" }, @@ -13256,18 +19786,29 @@ "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "repo", - "org_id", - "actor", + "@timestamp", + "_document_id", "action", - "request_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "_document_id", + "operation_type", "created_at" ] }, @@ -13276,17 +19817,30 @@ "description": "GitHub made a security advisory public in the GitHub Advisory Database.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -13295,21 +19849,30 @@ "description": "GitHub withdrew a security advisory that was published in error.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -13317,18 +19880,30 @@ "description": "Someone opened a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", "repo_id", - "action", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13336,21 +19911,30 @@ "description": "Someone published a security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", "@timestamp", - "actor", - "repo_id", "_document_id", - "repo", - "business_id", - "business", - "request_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "org" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13358,17 +19942,30 @@ "description": "Someone reopened as draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "repo", - "action", + "operation_type", "created_at", - "@timestamp", - "request_id", - "actor_id", - "_document_id", - "actor", - "repo_id", "public_repo" ] }, @@ -13377,21 +19974,30 @@ "description": "Someone edited a draft or published security advisory.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "repo_id", - "org_id", "business", - "actor", - "user_agent", - "created_at", - "_document_id", "business_id", - "repo", - "action", - "operation_type", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13399,24 +20005,30 @@ "description": "Branch protections were disabled for the repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -13425,24 +20037,30 @@ "description": "Branch protections were enabled for this repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -13451,25 +20069,31 @@ "description": "Code security was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -13478,25 +20102,31 @@ "description": "Code security was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -13505,19 +20135,30 @@ "description": "Data use settings were disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "repo_id", - "request_id", - "actor_id", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -13526,21 +20167,30 @@ "description": "Data use settings were enabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "org", - "user_id", - "repo_id", "@timestamp", - "request_id", - "actor", + "_document_id", "action", - "operation_type", - "created_at", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org_id", - "_document_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -13549,23 +20199,30 @@ "description": "The dependency graph was disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "repo_id", - "operation_type", - "user_id", - "repo", + "@timestamp", "_document_id", - "actor", - "user", "action", - "@timestamp", - "org_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", - "request_id", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -13574,24 +20231,31 @@ "description": "The dependency graph was enabled for a private repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "org", - "org_id", - "action", - "repo", "user_id", - "created_at", "user_agent", - "actor_id", - "repo_id", + "created_at", "operation_type", - "actor", - "@timestamp", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13600,19 +20264,29 @@ "description": "Dependency updates on self-hosted runners was disabled.", "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -13623,23 +20297,32 @@ "description": "Dependency updates on self-hosted runners was enabled.", "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners", "fields": [ - "topic", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "topic", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "actor_is_agent" ], @@ -13650,21 +20333,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -13672,21 +20365,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -13694,21 +20397,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -13716,20 +20430,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -13737,21 +20463,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -13759,19 +20496,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -13779,17 +20529,31 @@ "description": "An organization has reached their repository limit.", "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "limit", "count", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -13800,17 +20564,31 @@ "description": "An organization is approaching their repository limit.", "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "limit", "count", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -13821,19 +20599,30 @@ "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", "fields": [ - "request_id", - "created_at", + "@timestamp", "_document_id", "action", - "user_agent", - "user", - "business_id", - "business", - "operation_type", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -13842,20 +20631,30 @@ "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "created_at", "@timestamp", - "repo", - "action", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "repo_id", - "actor", - "request_id", - "programmatic_access_type" + "created_at", + "operation_type" ] }, { @@ -13864,20 +20663,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", "created_at", - "org_id", - "action", - "user_id", - "operation_type", - "_document_id", - "actor_id", - "repo" + "operation_type" ] }, { @@ -13885,31 +20693,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -13918,19 +20734,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -13938,8 +20765,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -13948,23 +20774,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -13989,26 +20824,32 @@ "description": "Automatic partner validation checks have been disabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -14017,26 +20858,32 @@ "description": "Automatic partner validation checks have been enabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -14044,24 +20891,31 @@ "action": "repository_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", - "fields": [ - "user_agent", - "request_id", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14071,23 +20925,30 @@ "description": "A custom pattern was removed from secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14097,24 +20958,31 @@ "description": "A custom pattern was published for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14124,24 +20992,31 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -14150,24 +21025,31 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14177,23 +21059,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14203,23 +21092,31 @@ "description": "Secret scanning was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "public_repo", - "programmatic_access_type" + "public_repo" ], "docs_reference_titles": "About secret scanning" }, @@ -14228,22 +21125,30 @@ "description": "Secret scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14251,25 +21156,31 @@ "description": "Metadata for secret scanning alerts has been disabled at the repository level", "docs_reference_links": "/code-security/secret-scanning/enabling-secret-scanning-features/enabling-extended-metadata-checks-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enabling extended metadata checks for your repository" @@ -14279,24 +21190,32 @@ "description": "Generic secrets have been disabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14304,22 +21223,31 @@ "description": "Generic secrets have been enabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14328,24 +21256,32 @@ "description": "Secret scanning for non-provider patterns was disabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -14354,24 +21290,32 @@ "description": "Secret scanning for non-provider patterns was enabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -14380,19 +21324,31 @@ "description": "A role or team was added to the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -14401,24 +21357,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -14427,24 +21391,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -14453,19 +21425,31 @@ "description": "A role or team was removed from the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -14474,26 +21458,31 @@ "description": "Secret scanning push protection was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "public_repo", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -14502,26 +21491,31 @@ "description": "Secret scanning push protection was enabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -14530,28 +21524,36 @@ "description": "A code security configuration was applied to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14559,27 +21561,35 @@ "description": "A code security configuration failed to attach to the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14587,28 +21597,36 @@ "description": "A code security configuration was removed from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14616,28 +21634,36 @@ "description": "A code security configuration was removed due to a change in repository or enterprise settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14645,19 +21671,29 @@ "description": "Dependabot security updates was disabled.", "docs_reference_links": "/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -14668,27 +21704,31 @@ "description": "Dependabot security updates was enabled.", "docs_reference_links": "/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates", "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "actor_is_agent" ], @@ -14699,20 +21739,30 @@ "description": "The repository visibility change setting was cleared for an organization or enterprise.", "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", "fields": [ - "created_at", + "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", "business", - "action", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business_id", - "@timestamp", "user_agent", - "actor", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise" }, @@ -14721,20 +21771,30 @@ "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org_id", - "created_at", - "user_agent", - "actor", - "actor_id", - "org", - "operation_type", - "_document_id", - "@timestamp", "user_id", - "action", - "request_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14742,19 +21802,30 @@ "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "_document_id", "@timestamp", - "user_agent", - "user", - "created_at", - "org", - "org_id", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14762,29 +21833,37 @@ "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -14793,29 +21872,37 @@ "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -14824,19 +21911,32 @@ "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ - "operation_type", - "request_id", - "repo_id", "@timestamp", - "user_agent", - "alert_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "alert_id", + "created_at", + "alert_number" ], "docs_reference_titles": "About Dependabot alerts" }, @@ -14845,23 +21945,32 @@ "description": "A Dependabot alert was manually dismissed.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "operation_type", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "alert_id", - "actor", - "repo", "created_at", - "org", - "_document_id", - "action", - "actor_id", "dismiss_reason", - "user", "dismiss_comment", "alert_number", "actor_is_bot" @@ -14872,21 +21981,33 @@ "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "public_repo", "owner", - "_document_id", - "@timestamp", "operation_type", - "token_scopes", "alert_number" ] }, @@ -14895,26 +22016,34 @@ "description": "A Dependabot alert was manually reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type", - "business", - "business_id", "public_repo", - "alert_number", - "request_access_security_header" + "alert_number" ] }, { @@ -14922,21 +22051,32 @@ "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", "docs_reference_links": "N/A", "fields": [ - "alert_id", - "repo", - "operation_type", - "action", - "repo_id", - "_document_id", - "user_agent", - "request_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "alert_id", + "operation_type", + "created_at", + "alert_number" ] }, { @@ -14944,21 +22084,35 @@ "description": "A Dependabot alert was withdrawn.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", "created_at", "active", - "action", - "repository_id", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type" ] }, @@ -14967,20 +22121,30 @@ "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", "fields": [ - "org", + "@timestamp", "_document_id", - "repo", - "org_id", - "operation_type", - "created_at", - "actor", "action", - "@timestamp", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" }, @@ -14989,24 +22153,31 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -15014,26 +22185,32 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15041,23 +22218,30 @@ "description": "Dependabot alerts was disabled.", "docs_reference_links": "N/A", "fields": [ - "repo", - "request_id", - "repo_id", - "action", - "actor_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "_document_id", "user_id", - "operation_type", - "token_scopes", - "programmatic_access_type" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -15065,23 +22249,30 @@ "description": "Dependabot alerts was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_agent", - "created_at", "@timestamp", - "repo_id", + "_document_id", "action", - "user", - "repo", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor_id", - "_document_id", - "user_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot" ] }, @@ -15090,24 +22281,31 @@ "description": "A status check was marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "org", - "actor_id", "@timestamp", - "business", - "request_id", - "context", - "repo_id", - "action", - "repo", "_document_id", - "operation_type", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "actor", - "created_at", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "context", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -15116,21 +22314,31 @@ "description": "A status check was no longer marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "actor_id", - "actor", - "created_at", - "context", - "operation_type", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "repo_id", "org_id", - "action", - "_document_id", + "programmatic_access_type", "repo", - "programmatic_access_type" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "context", + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -15139,18 +22347,31 @@ "description": "Email notification restrictions for an organization or enterprise were disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "business", - "business_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -15159,19 +22380,31 @@ "description": "Email notification restrictions for an organization or enterprise were enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -15180,22 +22413,33 @@ "description": "A new custom repository role was created.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "owner", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", - "_document_id", "role_permissions", "old_role_permissions" ], @@ -15206,23 +22450,34 @@ "description": "A custom repository role was deleted.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Managing custom repository roles for an organization" }, @@ -15231,23 +22486,34 @@ "description": "A custom repository role was edited.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "old_role_permissions", "old_base_role" ], @@ -15258,14 +22524,28 @@ "description": "A user was assigned to a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15280,14 +22560,28 @@ "description": "GitHub detected a secret and created a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15301,14 +22595,28 @@ "description": "A secret scanning alert was deleted by GitHub.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15324,14 +22632,28 @@ "description": "A secret scanning alert was leaked in a public repo.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15346,38 +22668,62 @@ "description": "A secret scanning alert was reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type_display_name" ] }, { "action": "secret_scanning_alert.report", "description": "A leaked secret was reported to the secret's provider by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts", - "fields": [ - "repo_id", - "repo", - "actor_id", + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "created_at", @@ -15392,28 +22738,37 @@ "description": "A secret scanning alert was resolved.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "resolution", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", + "resolution", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type", "secret_type_display_name", "publicly_leaked", - "multi_repo", - "request_access_security_header" + "multi_repo" ] }, { @@ -15421,25 +22776,32 @@ "description": "A secret scanning alert was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -15447,14 +22809,28 @@ "description": "A user was unassigned from a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15469,14 +22845,28 @@ "description": "A secret scanning alert was validated.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "previous_validity", @@ -15493,26 +22883,34 @@ "description": "A request to close a secret scanning alert was approved by a user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "request_reviewer_comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15521,25 +22919,33 @@ "description": "N/A", "docs_reference_links": "A reqeust to close a secret scanning alert was canceled by a user.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "A, reqeust, to, close, a, secret, scanning, alert, was, canceled, by, a, user." @@ -15549,27 +22955,35 @@ "description": "N/A", "docs_reference_links": "A user requested to close a secret scanning alert.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "reason", "comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "A, user, requested, to, close, a, secret, scanning, alert." @@ -15579,26 +22993,34 @@ "description": "A request to close a secret scanning alert was denied by a user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "request_reviewer_comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", + "operation_type", "actor_is_bot" ] }, @@ -15607,19 +23029,30 @@ "description": "Secret scanning was disabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -15628,19 +23061,30 @@ "description": "Secret scanning was enabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -15649,20 +23093,30 @@ "description": "Secret scanning was disabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -15671,19 +23125,30 @@ "description": "Secret scanning was enabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -15692,14 +23157,28 @@ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "push_protection_bypass_reason", @@ -15717,25 +23196,33 @@ "description": "A request to bypass secret scanning push protection was approved by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -15744,24 +23231,32 @@ "description": "A user canceled a request to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" @@ -15771,24 +23266,32 @@ "description": "A user pushed a commit containing a secret for which there is an approved secret scanning push protection bypass request.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" @@ -15798,25 +23301,33 @@ "description": "A request to bypass secret scanning push protection was denied by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", - "request_access_security_header", "request_reviewer_comment" ], "docs_reference_titles": "About push protection" @@ -15826,25 +23337,33 @@ "description": "A user requested to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" }, @@ -15853,22 +23372,35 @@ "description": "A secret scanning scan has completed on this repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "repo_id", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "source", "type", "source_slug", "type_slug", "started_at", "completed_at", - "repo", "public_repo", - "org", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "secret_types", @@ -15882,10 +23414,28 @@ "description": "A security configuration was created", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15900,15 +23450,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -15926,22 +23469,33 @@ "description": "A default security configuration setting for new repositories was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15950,22 +23504,33 @@ "description": "A default security configuration setting for new repositories was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15974,10 +23539,28 @@ "description": "A security configuration was deleted", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15992,15 +23575,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -16017,15 +23593,30 @@ "description": "A security configuration policy was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enforcement", "security_configuration_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16035,10 +23626,28 @@ "description": "A security configuration was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -16053,15 +23662,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -16079,16 +23681,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16098,18 +23713,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "org", - "org_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -16118,16 +23746,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16137,15 +23778,28 @@ "description": "An agreement for invoiced billing for GitHub Sponsors was signed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -16157,15 +23811,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -16175,15 +23842,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -16192,17 +23874,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -16211,17 +23906,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -16230,16 +23939,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -16249,14 +23971,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -16266,17 +24003,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -16285,17 +24035,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "created_at", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -16304,18 +24067,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16324,15 +24100,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -16342,16 +24132,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16359,15 +24162,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -16378,16 +24194,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -16397,17 +24226,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -16418,17 +24260,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -16439,18 +24294,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16460,16 +24326,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16479,16 +24358,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "sponsors_listing_id", "created_at", "operation_type" ] @@ -16500,17 +24392,30 @@ "fields": [ "@timestamp", "_document_id", - "fingerprint", - "operation_type", - "openssh_public_key", - "org_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "request_id" + "fingerprint", + "operation_type", + "openssh_public_key", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16519,19 +24424,32 @@ "description": "An SSH certificate authority for an organization or enterprise was deleted.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "created_at", + "@timestamp", "_document_id", - "fingerprint", - "operation_type", + "action", "actor", - "org_id", - "openssh_public_key", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", - "request_id" + "created_at", + "fingerprint", + "operation_type", + "openssh_public_key" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16540,21 +24458,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "user", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "request_id", - "org", - "org_id", - "created_at", - "actor", "action", - "user_id", + "actor", + "actor_id", "business", "business_id", - "@timestamp", - "actor_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16563,19 +24490,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "actor_id", - "user_id", - "org", - "operation_type", - "request_id", "@timestamp", "_document_id", - "actor", - "user", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16584,15 +24522,28 @@ "description": "Dependabot encrypted config was read.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "public_repo" @@ -16603,20 +24554,34 @@ "description": "The verification code expiry time for an organization or enterprise domain was set.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "token_expires_at", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16624,18 +24589,33 @@ "description": "An organization or enterprise domain was unverified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ] }, { @@ -16643,16 +24623,31 @@ "description": "An organization or enterprise domain was verified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "domain_name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16660,23 +24655,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16684,23 +24689,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16708,23 +24723,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16732,23 +24757,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16756,21 +24791,31 @@ "description": "A member of an organization was added to a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", "fields": [ - "user_agent", - "request_id", - "org_id", - "user_id", - "team", - "user", "@timestamp", - "actor_id", - "created_at", - "operation_type", "_document_id", - "org", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" @@ -16780,22 +24825,31 @@ "description": "A team was given access and permissions to a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "team", - "action", - "operation_type", - "request_id", - "created_at", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "actor_id", - "_document_id", "repo_id", - "user_agent", - "org_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -16804,20 +24858,30 @@ "description": "A team was added to an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team_type", "team", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -16828,20 +24892,31 @@ "description": "A child team was created or a child team's parent was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", "fields": [ - "org", "@timestamp", - "created_at", "_document_id", - "team", "action", - "operation_type", "actor", - "request_id", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", + "operation_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" }, @@ -16850,18 +24925,31 @@ "description": "A team's privacy level was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", "fields": [ - "user_agent", - "request_id", - "org", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", "created_at", "operation_type", - "actor_id", - "org_id", - "@timestamp", - "actor", - "_document_id", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" @@ -16871,21 +24959,32 @@ "description": "A new team is created.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "oauth_application_id", + "operation_type", "team", - "org", - "actor", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "team_type" ] }, @@ -16894,21 +24993,31 @@ "description": "A user was demoted from a team maintainer to a team member.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" }, @@ -16917,19 +25026,31 @@ "description": "A team was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "team", "org_id", - "actor_id", - "actor", - "action", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", "operation_type", - "_document_id", - "programmatic_access_type", "team_type" ] }, @@ -16938,19 +25059,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "actor", - "action", - "operation_type", - "team", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "team" ] }, { @@ -16958,19 +25091,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", "@timestamp", - "actor_id", "_document_id", - "team", - "created_at", - "org_id", "action", - "request_id", - "user_agent", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_access_security_header" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "team", + "created_at" ] }, { @@ -16978,22 +25123,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "team", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at" ] }, { @@ -17001,22 +25155,31 @@ "description": "A user was promoted from a team member to a team maintainer.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" }, @@ -17025,20 +25188,30 @@ "description": "A team was removed from an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team_type", "team", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -17049,22 +25222,31 @@ "description": "An organization member was removed from a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", "fields": [ - "request_id", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "team", - "user_id", - "actor", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", + "user_id", "user_agent", - "_document_id", - "token_scopes", - "programmatic_access_type", + "operation_type", + "created_at", + "team", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" @@ -17074,43 +25256,64 @@ "description": "A repository was removed from a team's control.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "org_id", - "repo", - "repo_id", - "action", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "created_at", "team", - "org", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { "action": "team.rename", - "description": "A team's name was changed.", - "docs_reference_links": "N/A", - "fields": [ - "name", - "user_agent", - "created_at", - "team", - "operation_type", - "actor_id", - "org", + "description": "A team's name was changed.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", "action", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "_document_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "team", + "operation_type", "team_type" ] }, @@ -17119,17 +25322,30 @@ "description": "Team synchronization with a tenant was disabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "request_id", - "org_id", "actor_id", - "operation_type", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -17138,19 +25354,30 @@ "description": "Team synchronization with a tenant was enabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ - "org_id", - "business_id", - "actor", - "created_at", - "user_agent", "@timestamp", - "operation_type", - "business", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -17159,19 +25386,30 @@ "description": "The Okta credentials for team synchronization with a tenant were changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -17179,28 +25417,37 @@ "description": "A team's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "team", - "org_id", "@timestamp", - "org", "_document_id", - "old_permission", - "request_id", - "repo", "action", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "old_permission", "operation_type", "created_at", - "user_agent", "permission", "new_repo_permission", "new_repo_base_role", "old_repo_permission", - "old_repo_base_role", - "token_scopes", - "programmatic_access_type" + "old_repo_base_role" ] }, { @@ -17208,23 +25455,38 @@ "description": "Triggered when a user content edit is deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_content_id", "user_content_type", "created_at", - "user_agent", "deleted_by", "editor_id", - "_document_id", "deleted_at", - "action", - "actor_id", "editor", "deleted_by_id", "deleted_content", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -17232,16 +25494,30 @@ "description": "A Dependabot rule was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17251,16 +25527,30 @@ "description": "A Dependabot rule was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17270,18 +25560,31 @@ "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17291,21 +25594,33 @@ "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17313,21 +25628,32 @@ "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -17335,21 +25661,32 @@ "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -17357,16 +25694,30 @@ "description": "A Dependabot rule's conditions, actions, or metadata changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17376,27 +25727,33 @@ "description": "A workflow job was approved.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", - "repo", - "repo_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -17405,23 +25762,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17429,10 +25796,28 @@ "description": "A workflow run was cancelled.", "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17443,20 +25828,9 @@ "run_number", "cancelled_at", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Canceling a workflow run" }, @@ -17465,23 +25839,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17491,10 +25873,28 @@ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17506,19 +25906,9 @@ "conclusion", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -17529,10 +25919,28 @@ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17541,21 +25949,10 @@ "head_branch", "head_sha", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "public_repo", - "programmatic_access_type", "actor_is_bot", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "Understanding GitHub Actions" @@ -17565,23 +25962,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -17590,22 +25999,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -17613,21 +26033,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -17635,25 +26066,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -17661,23 +26100,36 @@ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", "fields": [ - "repo_id", - "repo", - "org_id", - "org", - "business_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "job_name", "runner_labels", "is_hosted_runner", "environment_name", "secrets_passed", - "action", - "_document_id", "operation_type", "created_at", - "@timestamp", "runner_owner_type", "job_workflow_ref", "calling_workflow_refs", @@ -17691,24 +26143,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -17717,10 +26178,28 @@ "description": "A workflow run was re-run.", "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17730,21 +26209,11 @@ "head_sha", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", "rerun_type", "check_run_id", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "Re-running workflows and jobs" @@ -17754,25 +26223,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/fpt/user.json b/src/audit-logs/data/fpt/user.json index d12883c8b51a..86bcc2b8bf74 100644 --- a/src/audit-logs/data/fpt/user.json +++ b/src/audit-logs/data/fpt/user.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,17 +67,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "request_id", "@timestamp", - "user_agent", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", - "user_id", + "token_scopes", "user", - "actor", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -61,18 +98,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", + "token_scopes", "user", - "request_id", - "_document_id", - "user_agent", - "actor", "user_id", - "actor_id", - "operation_type", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -80,18 +129,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "actor_id", - "operation_type", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "token_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -99,29 +160,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -129,18 +196,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -148,21 +227,34 @@ "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -178,22 +270,34 @@ "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "uuid", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -201,25 +305,37 @@ "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", - "request_access_security_header", "old_target_amount", "old_budget_limit_type", "old_alert_enabled", @@ -233,17 +349,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -252,19 +381,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -273,15 +414,28 @@ "description": "Azure subscription has been linked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -291,15 +445,28 @@ "description": "Azure subscription has been unlinked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -309,18 +476,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -328,16 +508,28 @@ "description": "The premium request paid usage policy for your GitHub account was changed.", "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -349,18 +541,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -368,15 +572,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -386,26 +603,36 @@ "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -413,24 +640,34 @@ "description": "A CSV export was requested on the \"Coverage\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -438,26 +675,36 @@ "description": "A CSV export was requested on the \"Overview Dashboard\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "user", - "user_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -465,20 +712,31 @@ "description": "A CSV export was requested on the \"Risk\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -489,17 +747,29 @@ "description": "The cache retention policy for GitHub Actions was set for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type", "actor_is_bot" @@ -511,17 +781,29 @@ "description": "The cache storage policy for GitHub Actions was set for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type", "actor_is_bot" @@ -533,17 +815,30 @@ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "created_at", "operation_type" ], @@ -554,20 +849,32 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -576,19 +883,32 @@ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "limit", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -597,19 +917,31 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -618,20 +950,32 @@ "description": "The policy for fork pull request workflows was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -640,19 +984,31 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -661,20 +1017,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -683,20 +1050,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -707,17 +1085,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -725,14 +1115,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -742,25 +1147,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -771,22 +1185,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -798,22 +1223,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -822,15 +1258,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -841,17 +1292,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -861,27 +1325,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", "org", - "owner", - "pull_request_id", - "machine_type", - "user_id", - "user", - "devcontainer_path", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "owner", + "pull_request_id", + "machine_type", + "devcontainer_path", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -889,19 +1362,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -909,18 +1395,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -929,23 +1427,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -953,16 +1458,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -971,24 +1490,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -996,15 +1521,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1014,20 +1552,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -1035,19 +1583,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -1055,21 +1615,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1077,22 +1646,33 @@ "description": "Specific repositories were disabled from using Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "owner_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1100,21 +1680,31 @@ "description": "Specific repositories were enabled to use Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "owner_type", - "owner", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1124,20 +1714,32 @@ "description": "Copilot coding agent access was updated for the organization's or user's repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_access", "old_access", - "org_id", "owner_type", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1147,21 +1749,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1171,19 +1782,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1193,21 +1813,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1217,19 +1846,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1238,19 +1878,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1259,19 +1910,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1280,19 +1942,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1301,25 +1974,33 @@ "description": "Dismissal of Dependabot alerts was approved.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -1329,25 +2010,33 @@ "description": "Dismissal request for Dependabot alerts was canceled.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -1357,25 +2046,33 @@ "description": "Dismissal of Dependabot alerts was requested.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -1385,25 +2082,33 @@ "description": "Dismissal of Dependabot alerts was denied.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -1413,17 +2118,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1431,19 +2149,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1452,19 +2181,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1472,19 +2212,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1493,19 +2244,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1513,19 +2275,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1534,19 +2307,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1554,19 +2338,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1575,20 +2370,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1596,22 +2401,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1620,22 +2434,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1643,28 +2467,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1673,27 +2503,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -1702,25 +2540,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1729,26 +2575,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1757,21 +2610,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1780,22 +2645,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1804,25 +2679,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1831,22 +2715,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1855,21 +2751,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -1880,21 +2786,32 @@ "description": "A gist was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "gist_id", - "@timestamp", "created_at", "operation_type", - "user_agent", - "actor", - "actor_id", - "visibility", - "action", - "_document_id", - "token_scopes", - "programmatic_access_type" + "visibility" ] }, { @@ -1902,42 +2819,65 @@ "description": "A gist was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "gist_id", - "visibility", - "created_at", + "@timestamp", "_document_id", - "user", - "request_id", - "operation_type", + "action", "actor", "actor_id", - "action", - "user_agent", - "@timestamp", - "programmatic_access_type" - ] + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "gist_id", + "visibility", + "created_at", + "operation_type" + ] }, { "action": "gist.visibility_change", "description": "The visibility of a gist was updated.", "docs_reference_links": "N/A", "fields": [ - "action", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", - "user", - "gist_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "visibility", - "user_id", - "created_at", - "_document_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "gist_id", + "visibility", + "created_at" ] }, { @@ -1945,22 +2885,33 @@ "description": "An SSH key was added to a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -1969,23 +2920,34 @@ "description": "An SSH key was removed from a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", "explanation", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -1994,23 +2956,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2018,18 +2989,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -2040,20 +3021,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2063,18 +3054,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "created_at", - "user_id", "@timestamp", - "user", - "operation_type", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -2082,18 +3085,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "created_at", - "_document_id", + "user_id", "user_agent", - "@timestamp", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -2101,25 +3116,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "name", - "events", - "active", - "active_was", - "hook_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "events", + "active", + "active_was", + "hook_id", + "operation_type" ] }, { @@ -2127,25 +3152,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -2153,26 +3187,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -2181,25 +3224,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -2207,26 +3259,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -2234,21 +3295,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -2257,19 +3329,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -2277,21 +3362,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -2300,19 +3396,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -2323,20 +3433,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2346,24 +3468,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2374,23 +3507,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2401,20 +3546,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2424,19 +3582,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -2445,20 +3617,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -2468,20 +3653,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -2490,20 +3688,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -2512,40 +3723,65 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "name", - "integration", - "user", - "user_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", - "request_access_security_header" - ] - }, - { - "action": "integration.revoke_all_tokens", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at" + ] + }, + { + "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2554,19 +3790,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2575,17 +3824,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2598,21 +3860,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -2626,17 +3901,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2648,20 +3936,30 @@ "description": "An issue was marked as blocked by another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -2672,19 +3970,30 @@ "description": "The blocked by relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2694,20 +4003,30 @@ "description": "An issue was marked as blocking another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -2718,20 +4037,30 @@ "description": "The blocking relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", + "public_repo", "created_at", "operation_type", "actor_is_bot" @@ -2742,18 +4071,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2761,21 +4102,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -2783,21 +4137,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -2805,22 +4172,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -2828,19 +4208,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -2851,21 +4244,36 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "actor", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", "marketplace_listing", "has_free_trial", - "user_agent", - "request_id", - "actor_id", "yearly_price_in_cents", "description", "bullets", "monthly_price_in_cents", - "marketplace_listing_plan", - "_document_id" + "marketplace_listing_plan" ] }, { @@ -2873,22 +4281,37 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "marketplace_listing_plan", "marketplace_listing", "description", "bullets", "has_free_trial", "created_at", - "actor_id", "operation_type", - "_document_id", - "action", - "user_agent", - "request_id", - "actor", "monthly_price_in_cents", - "yearly_price_in_cents", - "@timestamp" + "yearly_price_in_cents" ] }, { @@ -2896,21 +4319,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor", - "marketplace_listing_plan", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "marketplace_listing_plan", "description", "yearly_price_in_cents", - "@timestamp", "created_at", - "actor_id", "bullets", "has_free_trial", "marketplace_listing", - "user_agent", "monthly_price_in_cents", - "action", "operation_type" ] }, @@ -2919,45 +4357,73 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "monthly_price_in_cents", - "marketplace_listing", + "@timestamp", "_document_id", "action", - "description", - "bullets", - "yearly_price_in_cents", - "request_id", - "actor_id", - "has_free_trial", - "marketplace_listing_plan", - "user_agent", - "@timestamp", - "operation_type", "actor", - "created_at" - ] - }, - { - "action": "marketplace_listing.redraft", - "description": "A listing was sent back to draft state.", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "monthly_price_in_cents", + "marketplace_listing", + "description", + "bullets", + "yearly_price_in_cents", + "has_free_trial", + "marketplace_listing_plan", + "operation_type", + "created_at" + ] + }, + { + "action": "marketplace_listing.redraft", + "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -2965,22 +4431,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2988,19 +4467,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3008,21 +4499,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3032,16 +4532,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3051,18 +4564,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3072,14 +4598,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -3087,19 +4629,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -3107,42 +4660,62 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "org", - "created_at", - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", - "request_access_security_header" - ] - }, - { + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -3150,20 +4723,30 @@ "description": "An OAuth access token was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", "fields": [ - "_document_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "user", - "user_id", - "created_at", + "_document_id", "action", + "actor", "actor_id", - "request_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" @@ -3174,19 +4757,30 @@ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", "fields": [ "@timestamp", - "user_agent", - "action", - "operation_type", "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_id", + "user_agent", + "operation_type", + "created_at", "explanation", - "hashed_token", - "actor_id", - "token_scopes", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" @@ -3196,19 +4790,30 @@ "description": "An OAuth access token was regenerated.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "_document_id", - "created_at", "@timestamp", - "operation_type", + "_document_id", "action", - "user_agent", - "request_id", "actor", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "oauth_application_name" ] }, @@ -3217,16 +4822,28 @@ "description": "An OAuth access token was revoked.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "request_access_security_header", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -3236,18 +4853,30 @@ "description": "An OAuth access token was updated.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -3255,20 +4884,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3277,20 +4918,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3299,42 +4952,66 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application", - "oauth_application_id", - "user", - "user_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", - "request_access_security_header" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + }, + { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3343,19 +5020,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3364,20 +5054,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3386,20 +5088,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3408,19 +5122,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3429,24 +5156,31 @@ "description": "An authorization for an OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ - "operation_type", - "user_agent", - "user_id", - "actor", - "org_id", + "@timestamp", "_document_id", - "request_id", "action", - "@timestamp", - "created_at", + "actor", "actor_id", - "user", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_is_bot", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -3456,20 +5190,31 @@ "description": "An authorization for an OAuth application was deleted.", "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", "fields": [ - "user_agent", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "actor", "created_at", "explanation", - "user", - "user_id", - "org_id", - "action", - "actor_id", - "token_scopes", "actor_is_bot", "oauth_application_name" ], @@ -3480,20 +5225,31 @@ "description": "An authorization for an OAuth application was updated.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", - "actor_id", "user_agent", - "@timestamp", "operation_type", - "action", - "user", "created_at", - "_document_id", "actor_is_bot", - "request_access_security_header", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -3503,21 +5259,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -3526,24 +5292,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3551,20 +5327,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -3572,22 +5358,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -3595,20 +5389,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -3616,22 +5420,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -3639,21 +5451,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3661,26 +5482,35 @@ "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -3689,26 +5519,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3716,28 +5554,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user", - "user_id", - "query", - "filename", - "requested_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "query", + "filename", + "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3745,26 +5591,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3772,18 +5626,28 @@ "description": "The cache retention policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -3795,18 +5659,28 @@ "description": "The cache storage policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -3818,20 +5692,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -3840,16 +5725,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -3860,18 +5758,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -3880,18 +5791,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -3900,18 +5823,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -3920,18 +5856,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -3941,20 +5889,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -3962,17 +5921,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -3982,20 +5954,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -4004,20 +5987,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -4026,17 +6023,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4047,20 +6059,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -4069,19 +6095,31 @@ "description": "A new passkey was added.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4089,19 +6127,31 @@ "description": "A new passkey was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4109,18 +6159,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4128,35 +6190,61 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" - ] - }, - { - "action": "payment_method.update", - "description": "An existing payment method was updated.", - "docs_reference_links": "N/A", - "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "payment_method.update", + "description": "An existing payment method was updated.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -4164,18 +6252,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4186,18 +6287,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4208,17 +6322,30 @@ "description": "Triggered when you create a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4228,19 +6355,31 @@ "description": "Triggered when you regenerate a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4248,12 +6387,29 @@ "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", "fields": [ - "user_programmatic_access_name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", "operation_type" ], @@ -4264,20 +6420,32 @@ "description": "Triggered when you delete a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "explanation", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4285,17 +6453,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -4306,18 +6487,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -4329,17 +6523,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -4351,17 +6558,30 @@ "description": "A fine-grained personal access token was updated.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4372,15 +6592,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4390,17 +6625,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4410,15 +6656,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4428,17 +6689,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4448,17 +6720,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4468,17 +6751,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4488,17 +6782,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4508,17 +6813,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -4528,38 +6846,62 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "actor", - "user_agent", - "operation_type", - "user", - "created_at", - "user_id", - "action", - "request_id", + "@timestamp", "_document_id", - "@timestamp" - ] + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] }, { "action": "project.close", "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -4569,25 +6911,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -4595,20 +6949,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4616,25 +6982,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4642,17 +7020,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -4660,17 +7051,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -4678,18 +7082,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -4698,18 +7114,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -4718,19 +7146,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -4738,17 +7177,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -4760,22 +7212,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -4783,19 +7244,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -4803,17 +7275,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4821,18 +7306,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -4840,20 +7338,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4861,18 +7369,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -4881,18 +7401,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -4901,16 +7433,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -4922,21 +7467,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", + "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -4944,18 +7501,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4966,23 +7536,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -4991,24 +7572,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -5017,20 +7609,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -5039,21 +7645,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -5063,22 +7682,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -5087,25 +7718,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -5114,23 +7755,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", "key", "fingerprint", - "actor_id", - "actor", "title", - "user_agent", - "user_id", - "request_id", - "read_only", - "token_scopes", - "programmatic_access_type" + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -5139,22 +7791,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -5163,21 +7825,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -5186,25 +7857,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -5213,23 +7891,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -5238,24 +7924,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -5264,23 +7957,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -5290,22 +7991,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -5314,19 +8024,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -5335,24 +8058,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -5361,23 +8094,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -5388,17 +8130,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -5407,15 +8162,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -5426,16 +8194,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -5445,17 +8226,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -5465,19 +8259,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -5486,17 +8291,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -5505,26 +8323,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -5533,30 +8357,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -5566,20 +8395,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5588,25 +8428,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5615,23 +8463,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -5639,25 +8498,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -5667,23 +8535,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -5691,21 +8569,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -5713,21 +8601,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -5735,22 +8633,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -5758,65 +8665,95 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", - "actor", - "actor_id", - "user", - "operation_type", - "repo_id", - "action", - "repo", "_document_id", - "request_access_security_header" - ] - }, - { - "action": "repo.pages_private", - "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id" + "visibility", + "operation_type" ] }, { - "action": "repo.pages_public", - "description": "A GitHub Pages site visibility was changed to public.", + "action": "repo.pages_private", + "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", + "created_at" + ] + }, + { + "action": "repo.pages_public", + "description": "A GitHub Pages site visibility was changed to public.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -5824,18 +8761,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5843,22 +8794,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5866,21 +8827,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -5888,18 +8859,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -5908,22 +8891,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5932,24 +8924,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5958,23 +8958,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -5982,26 +8992,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -6010,21 +9025,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -6033,25 +9057,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -6059,22 +9089,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -6083,19 +9123,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -6103,22 +9154,30 @@ "description": "The cache retention policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -6130,22 +9189,30 @@ "description": "The cache storage policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -6157,46 +9224,66 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "public_repo" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" - }, - { + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", + "created_at", + "operation_type", + "public_repo" + ], + "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + }, + { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -6207,21 +9294,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -6230,22 +9328,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -6254,21 +9362,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -6277,22 +9396,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -6303,16 +9432,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -6321,22 +9461,31 @@ "description": "Temporary access was enabled for a repository.", "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing user-owned repositories in your enterprise" }, @@ -6346,22 +9495,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -6370,23 +9530,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -6396,19 +9566,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -6416,21 +9596,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -6439,24 +9629,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -6464,25 +9663,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -6491,24 +9697,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -6517,25 +9733,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -6544,22 +9768,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -6568,26 +9801,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -6595,31 +9836,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "created_at", - "oauth_application_id", - "user", - "@timestamp", - "repo", - "operation_type", - "request_id", - "org_id", "actor_id", - "visibility", - "old_permission", + "business", + "business_id", + "hashed_token", "org", - "user_id", - "old_base_role", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "visibility", + "old_permission", + "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -6628,21 +9876,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -6650,21 +9908,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -6672,21 +9940,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -6694,20 +9973,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -6715,21 +10006,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -6737,19 +10039,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -6757,31 +10072,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -6790,19 +10113,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -6810,8 +10144,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -6820,23 +10153,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -6861,18 +10203,30 @@ "description": "A security key was registered for an account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "created_at", - "user_id", - "action", - "operation_type", - "request_id", "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -6880,18 +10234,30 @@ "description": "A security key was removed from an account.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "operation_type", - "_document_id", - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6899,14 +10265,28 @@ "description": "A user linked a social identity to their account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -6916,14 +10296,28 @@ "description": "A user unlinked a social identity from their account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "action", - "_document_id", - "@timestamp", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -6933,15 +10327,28 @@ "description": "A user unlinked all social identities from their account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -6951,16 +10358,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6970,18 +10390,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -6990,16 +10423,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -7010,15 +10456,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -7028,16 +10487,31 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", - "user_id", - "@timestamp" - ], + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], "docs_reference_titles": "Downgrading a sponsorship" }, { @@ -7045,17 +10519,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -7064,17 +10551,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -7083,16 +10584,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -7102,14 +10616,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -7119,17 +10648,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -7138,17 +10680,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -7157,18 +10712,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7177,15 +10745,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -7195,16 +10777,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7212,15 +10807,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -7231,16 +10839,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -7250,17 +10871,30 @@ "description": "Triggered when you send an email update to your sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", "fields": [ - "request_id", - "actor", - "action", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" }, @@ -7269,17 +10903,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -7290,17 +10937,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -7311,18 +10971,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -7332,16 +11003,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -7351,17 +11035,30 @@ "description": "You join the waitlist to join GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "actor_id", - "action", "operation_type", - "created_at", - "user", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -7370,16 +11067,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -7389,23 +11099,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7413,23 +11133,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", + "public_repo", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7437,23 +11167,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7461,23 +11201,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7485,15 +11235,30 @@ "description": "Triggered when you accept a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7502,15 +11267,30 @@ "description": "Triggered when you cancel a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7519,15 +11299,30 @@ "description": "Triggered when you create a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7536,15 +11331,30 @@ "description": "Triggered when you decline a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7553,15 +11363,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7569,15 +11394,30 @@ "description": "Triggered when you revoke a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7586,17 +11426,30 @@ "description": "A new trusted device was added.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7604,17 +11457,30 @@ "description": "A trusted device was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7622,14 +11488,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "action", - "request_id", - "user_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -7638,15 +11519,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "created_at", - "user_id", - "operation_type", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action" + "created_at", + "operation_type" ] }, { @@ -7654,13 +11550,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "created_at", - "user_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7668,17 +11581,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "operation_type", - "action", - "_document_id" + "created_at", + "operation_type" ] }, { @@ -7686,17 +11612,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user", - "created_at", - "request_id", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -7704,16 +11643,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7721,15 +11674,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_id", - "action", "@timestamp", - "created_at", - "user_agent", - "user", "_document_id", - "request_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7737,18 +11705,30 @@ "description": "A secondary authentication factor was added to a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -7757,18 +11737,30 @@ "description": "Two-factor authentication was disabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", "fields": [ - "actor", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor_id", + "user_agent", "created_at", - "operation_type", - "request_id", - "@timestamp", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Disabling two-factor authentication for your personal account" }, @@ -7777,18 +11769,30 @@ "description": "Two-factor authentication was enabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ - "actor", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Configuring two-factor authentication" }, @@ -7797,15 +11801,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user", - "user_id", - "action", "@timestamp", - "request_id", "_document_id", - "user_agent" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7813,16 +11832,29 @@ "description": "Two factor recovery codes were regenerated for a user account.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", + "operation_type", "created_at" ] }, @@ -7831,18 +11863,30 @@ "description": "A secondary authentication factor was removed from a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -7851,15 +11895,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "created_at", - "_document_id", - "action", - "@timestamp" + "operation_type", + "created_at" ] }, { @@ -7868,16 +11927,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "operation_type", "user_agent", - "action", - "request_id", - "actor", - "actor_id" + "created_at", + "operation_type" ] }, { @@ -7885,19 +11957,31 @@ "description": "An email address was added to a user account.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", "operation_type", - "_document_id", - "actor_id", - "actor", "email", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding an email address to your GitHub account" }, @@ -7906,18 +11990,30 @@ "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "created_at", - "user", "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -7925,15 +12021,28 @@ "description": "Audit log entries were exported.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "action", - "request_id", - "actor", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", "created_at" ] @@ -7943,20 +12052,31 @@ "description": "A user was blocked by another user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_id", - "_document_id", "actor_id", - "@timestamp", - "user_agent", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -7964,18 +12084,30 @@ "description": "A user changed their password.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "actor_id", - "operation_type", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "created_at", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7983,18 +12115,30 @@ "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -8003,17 +12147,30 @@ "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -8022,19 +12179,31 @@ "description": "A new user account was created.", "docs_reference_links": "N/A", "fields": [ - "email", - "user_id", - "operation_type", "@timestamp", - "request_id", - "user", - "created_at", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "action", - "programmatic_access_type" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "email", + "operation_type", + "created_at" ] }, { @@ -8042,21 +12211,33 @@ "description": "A user secret for Codespaces was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8064,20 +12245,31 @@ "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "user_agent", + "@timestamp", "_document_id", - "operation_type", - "oauth_application_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "@timestamp", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -8085,18 +12277,30 @@ "description": "A user account was destroyed by an asynchronous job.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "request_id", - "user_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8105,19 +12309,30 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "oauth_application_id", + "_document_id", "action", - "user", - "created_at", - "user_agent", - "request_id", "actor", "actor_id", - "operation_type", - "_document_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", + "operation_type" ] }, { @@ -8125,18 +12340,30 @@ "description": "A user deleted his or her account, triggering user.async_delete.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", - "created_at", - "user_agent", "user_id", - "operation_type", - "actor_id", - "action", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8144,37 +12371,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", - "user", - "user_agent", - "user_id", - "actor_id", + "_document_id", "action", - "operation_type", - "request_access_security_header" - ] - }, - { - "action": "user.device_verification_requested", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", - "operation_type", + "user_agent", "created_at", - "_document_id", + "operation_type" + ] + }, + { + "action": "user.device_verification_requested", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "user", - "actor_id", + "_document_id", "action", - "request_access_security_header" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8183,17 +12434,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user", "_document_id", "action", - "operation_type", - "user_agent", - "created_at", - "request_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8201,17 +12464,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8219,17 +12495,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8237,17 +12526,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8255,21 +12557,31 @@ "description": "An enterprise managed user claimed an email address.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8277,21 +12589,31 @@ "description": "N/A", "docs_reference_links": "An enterprise managed user unclaimed an email address.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." }, @@ -8300,17 +12622,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8318,17 +12653,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8336,17 +12684,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8354,18 +12715,30 @@ "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "action", - "operation_type", - "request_id", - "created_at", - "_document_id", "@timestamp", - "user", - "org_id", + "_document_id", + "action", "actor", "actor_id", - "user_agent" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8373,17 +12746,31 @@ "description": "A user requested a password reset.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", "fields": [ - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "email", - "created_at", - "user_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" }, @@ -8392,17 +12779,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "created_at", - "user_agent", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor", - "operation_type", - "request_id" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8410,18 +12810,30 @@ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -8430,19 +12842,31 @@ "description": "A user signed in.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "actor_id", "@timestamp", - "user", - "action", - "operation_type", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "actor", - "passkey_nickname", - "request_access_security_header" + "passkey_nickname" ] }, { @@ -8450,18 +12874,30 @@ "description": "A user signed out.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8469,18 +12905,30 @@ "description": "A user signed in from a new device.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8488,21 +12936,31 @@ "description": "An ordinary user account was promoted to a site administrator.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", + "user_id", "user_agent", + "created_at", "oauth_application_id", - "request_id", - "operation_type", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8510,16 +12968,29 @@ "description": "A user's account was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user", - "action", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "actor", "operation_type" ] }, @@ -8528,20 +12999,31 @@ "description": "An email address was removed from a user account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "actor", - "actor_id", "created_at", - "email", - "token_scopes", - "programmatic_access_type" + "email" ] }, { @@ -8549,20 +13031,32 @@ "description": "A user secret for Codespaces was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "key", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "key", + "integration", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8570,20 +13064,31 @@ "description": "A username was changed.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "request_id", - "actor_id", - "old_login", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "operation_type", "user_agent", - "token_scopes", - "programmatic_access_type" + "old_login", + "created_at", + "operation_type" ] }, { @@ -8591,18 +13096,30 @@ "description": "A user reset their account password.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "@timestamp", - "_document_id", - "actor", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8610,16 +13127,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_id", - "action", "@timestamp", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -8630,16 +13160,28 @@ "fields": [ "@timestamp", "_document_id", - "request_id", - "user_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor_id", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -8648,18 +13190,30 @@ "description": "A user signed in from an unrecognized device.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "created_at", - "actor", - "actor_id", - "@timestamp", - "request_access_security_header" + "created_at" ] }, { @@ -8667,18 +13221,30 @@ "description": "A user signed in from an unrecognized device and location.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "created_at", - "_document_id", - "request_id", - "action", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8686,22 +13252,33 @@ "description": "Triggered when you clear the status on your profile.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "message", - "user", - "actor_id", "created_at", - "request_id", "limited_availability", - "action", "emoji", - "operation_type", - "user_agent", - "@timestamp", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -8709,23 +13286,33 @@ "description": "Triggered when you set or change the status on your profile.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", "fields": [ - "limited_availability", - "user", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "message", - "user_id", - "created_at", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "emoji", - "org", - "actor", - "operation_type", - "token_scopes", - "programmatic_access_type" + "limited_availability", + "message", + "created_at", + "emoji", + "operation_type" ], "docs_reference_titles": "Personalize your profile" }, @@ -8734,21 +13321,31 @@ "description": "A user account was suspended.", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", - "operation_type", - "actor_id", - "user", - "user_agent", - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", - "user_id", + "_document_id", "action", - "token_scopes", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -8756,18 +13353,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", - "actor_id", "@timestamp", - "operation_type", "_document_id", - "user_agent", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8775,18 +13384,30 @@ "description": "A 2FA challenge issued for a user account failed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "_document_id", - "user_agent", - "user", - "actor_id", - "actor", - "user_id", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8796,16 +13417,28 @@ "fields": [ "@timestamp", "_document_id", - "user_id", - "operation_type", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "actor", + "user_id", "user_agent", - "request_id", - "action", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8813,18 +13446,30 @@ "description": "A user used their 2FA recovery codes.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "user_agent", - "request_id", - "user", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "created_at", - "@timestamp", - "_document_id", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8832,18 +13477,30 @@ "description": "A user downloaded 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8851,17 +13508,30 @@ "description": "A user printed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", - "user_agent", - "request_id", - "user_id", - "created_at", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8869,18 +13539,30 @@ "description": "A user viewed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", "created_at", - "user", - "operation_type", - "@timestamp", - "request_id", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -8888,17 +13570,30 @@ "description": "A user was prompted for a two-factor authentication code.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", "fields": [ - "user", - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "actor" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" }, @@ -8907,19 +13602,31 @@ "description": "A user was unblocked by another user.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "actor", - "@timestamp", - "user_agent", - "user_id", - "user", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -8927,21 +13634,31 @@ "description": "A user account was unsuspended.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", - "user", "action", - "user_agent", "actor", - "oauth_application_id", - "operation_type", "actor_id", - "created_at", - "@timestamp", - "user_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -8949,21 +13666,33 @@ "description": "A user secret for Codespaces was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8971,46 +13700,64 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", + "operation_type" + ] + }, + { + "action": "workflows.approve_workflow_job", + "description": "A workflow job was approved.", + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" - ] - }, - { - "action": "workflows.approve_workflow_job", - "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", - "fields": [ "user_agent", - "request_id", - "actor", - "actor_id", "workflow_run_id", "run_number", - "user", - "user_id", - "repo", - "repo_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -9019,23 +13766,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9043,23 +13800,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9069,23 +13834,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -9094,22 +13871,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9117,21 +13905,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -9139,25 +13938,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9165,24 +13972,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -9191,25 +14007,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghec/enterprise.json b/src/audit-logs/data/ghec/enterprise.json index c97a1bf551dc..2c4795b8b6ca 100644 --- a/src/audit-logs/data/ghec/enterprise.json +++ b/src/audit-logs/data/ghec/enterprise.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,29 +67,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -72,21 +103,32 @@ "description": "Credit was accepted for a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Editing a repository security advisory" }, @@ -95,21 +137,32 @@ "description": "Someone was added to the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -117,21 +170,32 @@ "description": "Credit was declined for a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -140,21 +204,32 @@ "description": "Someone was removed from the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -163,31 +238,34 @@ "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests", "fields": [ - "user_agent", - "request_id", - "request_method", - "query_string", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", - "request_body", - "status_code", - "url_path", "business", "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "request_method", + "query_string", + "request_body", + "status_code", + "url_path", + "public_repo", "created_at", "operation_type", "route", @@ -201,18 +279,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -220,20 +310,32 @@ "description": "A manual check of the endpoint configured for audit log streaming was performed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "audit_log_stream_result", - "business_id", "business", - "action", - "_document_id", - "@timestamp", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_result", "created_at", "operation_type", - "audit_log_stream_sink_details", - "request_access_security_header" + "audit_log_stream_sink_details" ] }, { @@ -241,16 +343,29 @@ "description": "An endpoint was added for audit log streaming.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "business_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "audit_log_stream_sink", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "audit_log_stream_id" @@ -261,15 +376,28 @@ "description": "An audit log streaming endpoint was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "business_id", "business", - "action", - "_document_id", - "@timestamp", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "audit_log_stream_id", @@ -281,17 +409,30 @@ "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "audit_log_stream_enabled", - "business_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_enabled", "audit_log_stream_sink", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "new_s3_bucket", @@ -314,17 +455,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -335,20 +487,30 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" }, @@ -357,21 +519,34 @@ "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -387,22 +562,34 @@ "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "uuid", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -410,25 +597,37 @@ "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", - "request_access_security_header", "old_target_amount", "old_budget_limit_type", "old_alert_enabled", @@ -442,17 +641,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -461,19 +673,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", - "org_id", - "@timestamp", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -482,15 +706,28 @@ "description": "Azure subscription has been linked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -500,15 +737,28 @@ "description": "Azure subscription has been unlinked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -518,18 +768,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -537,16 +800,28 @@ "description": "The premium request paid usage policy for your GitHub account was changed.", "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -558,18 +833,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -577,15 +864,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -595,22 +895,31 @@ "description": "An enterprise owner was added to an enterprise.", "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", "fields": [ - "name", - "business", - "user", - "user_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "request_id", + "business", "business_id", - "_document_id", - "user_agent", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "operation_type" ], "docs_reference_titles": "Inviting people to manage your enterprise" }, @@ -619,20 +928,31 @@ "description": "A billing manager was added to an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user", + "@timestamp", + "_document_id", + "action", "actor", - "name", + "actor_id", "business", "business_id", - "action", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "operation_type", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "name", + "operation_type", + "created_at" ] }, { @@ -640,20 +960,30 @@ "description": "An enterprise prevented access to resources by users with the given two-factor method.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", - "two_factor_method", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "two_factor_method", "created_at", "operation_type", "actor_is_bot" @@ -664,22 +994,32 @@ "description": "An organization was added to an enterprise.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "operation_type", "@timestamp", - "actor", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "operation_type", "name", "created_at", - "request_id", - "_document_id", - "business", - "organization_upgrade", - "request_access_security_header" + "organization_upgrade" ] }, { @@ -687,20 +1027,31 @@ "description": "A support entitlement was added to a member of an enterprise.", "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/managing-support-entitlements-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing support entitlements for your enterprise" }, @@ -709,20 +1060,30 @@ "description": "GitHub Advanced Security was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -731,17 +1092,28 @@ "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -752,21 +1124,31 @@ "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -775,17 +1157,28 @@ "description": "GitHub Advanced Security was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -796,17 +1189,28 @@ "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -817,21 +1221,31 @@ "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -840,15 +1254,28 @@ "description": "Enablement for Advanced Security features on new repositories has been locked for this enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -859,15 +1286,28 @@ "description": "Enablement for Advanced Security features on new repositories has been unlocked for this enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -878,42 +1318,66 @@ "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "new_policy", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" - ], - "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "new_policy", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, { "action": "business.advanced_security_repo_admin_enablement_policy_update", "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -921,17 +1385,28 @@ "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -943,21 +1418,31 @@ "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -966,17 +1451,30 @@ "description": "An export of the enterprise audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", "docs_reference_links": "admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/exporting-audit-log-activity-for-your-enterprise", "fields": [ - "user_agent", - "business", - "business_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "request_id", - "actor", - "action", - "_document_id", "query_phrase" ], "docs_reference_titles": "Exporting audit log activity for your enterprise" @@ -986,19 +1484,32 @@ "description": "An export of the enterprise's Git events was created.", "docs_reference_links": "admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/exporting-audit-log-activity-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "start", "end", - "business", - "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Exporting audit log activity for your enterprise" }, @@ -1007,21 +1518,32 @@ "description": "An invitation for someone to be an owner of an enterprise was canceled.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "invitation_id", - "user_id", - "_document_id", "operation_type", "created_at", - "name", - "request_id", - "actor", - "@timestamp", - "business", - "business_id", - "action" + "name" ] }, { @@ -1029,21 +1551,32 @@ "description": "An invitation for someone to be an billing manager of an enterprise was canceled.", "docs_reference_links": "N/A", "fields": [ - "business_id", - "action", "@timestamp", - "actor", - "name", "_document_id", + "action", + "actor", "actor_id", - "created_at", "business", - "user_id", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "invitation_id", - "user" + "name", + "created_at", + "operation_type", + "invitation_id" ] }, { @@ -1051,16 +1584,29 @@ "description": "The trial of GitHub Enterprise Cloud was canceled.", "docs_reference_links": "/admin/overview/setting-up-a-trial-of-github-enterprise-cloud", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type" ], @@ -1071,18 +1617,31 @@ "description": "The seats plan type was changed for an enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "seats_plan_type_was", "seats_plan_type", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1093,18 +1652,31 @@ "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1113,17 +1685,30 @@ "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", "fields": [ - "name", - "operation_type", - "business_id", - "user_agent", - "actor_id", - "request_id", - "actor", + "@timestamp", "_document_id", - "business", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -1133,17 +1718,29 @@ "description": "Cleared two-factor authentication restrictions for an enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type", "actor_is_bot" @@ -1154,19 +1751,32 @@ "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", "business_id", - "action", - "_document_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "business", "visibility", "created_at", - "actor", - "operation_type", - "@timestamp" + "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -1175,21 +1785,33 @@ "description": "The policy for Code scanning autofix was updated for an enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1197,21 +1819,33 @@ "description": "The policy for Code scanning autofix third party tools was updated for an enterprise.", "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/getting-started/github-security-features#available-with-github-code-security" }, @@ -1220,18 +1854,30 @@ "description": "The policy for Code Security enablement was updated for an enterprise.", "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1243,15 +1889,28 @@ "description": "Enablement for Code Security features on new repositories has been locked for this enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1262,15 +1921,28 @@ "description": "Enablement for Code Security features on new repositories has been unlocked for this enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1281,32 +1953,62 @@ "description": "Server statistics were exported for the enterprise.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Exporting Server Statistics" - }, - { - "action": "business.convert_trial", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "operation_type" + ], + "docs_reference_titles": "Exporting Server Statistics" + }, + { + "action": "business.convert_trial", "description": "The enterprise account on a trial of GitHub Enterprise Cloud was upgraded to a paid enterprise account.", "docs_reference_links": "/admin/overview/setting-up-a-trial-of-github-enterprise-cloud", "fields": [ - "name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type" ], @@ -1317,19 +2019,31 @@ "description": "An enterprise was created.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", "_document_id", "action", - "@timestamp", - "request_id", - "name", + "actor", + "actor_id", "business", "business_id", - "operation_type", - "actor", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "name", + "operation_type", + "created_at" ] }, { @@ -1337,16 +2051,29 @@ "description": "A trial of GitHub Enterprise Cloud began.", "docs_reference_links": "/admin/overview/setting-up-a-trial-of-github-enterprise-cloud", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type" ], @@ -1357,16 +2084,29 @@ "description": "The enterprise was deleted.", "docs_reference_links": "/admin/overview/deleting-an-enterprise-account", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", "business", - "action", "business_id", - "@timestamp", - "operation_type", - "_document_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "operation_type", "name", "created_at" ], @@ -1377,17 +2117,28 @@ "description": "Dependabot alerts were disabled for your enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -1397,17 +2148,28 @@ "description": "Dependabot alerts were enabled for your enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -1417,17 +2179,28 @@ "description": "Dependabot alerts were disabled for new repositories in your enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -1437,17 +2210,28 @@ "description": "Dependabot alerts were enabled for new repositories in your enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -1457,17 +2241,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1477,38 +2274,62 @@ "description": "OIDC single sign-on was disabled for an enterprise.", "docs_reference_links": "/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/configuring-oidc-for-enterprise-managed-users", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "Configuring OIDC for Enterprise Managed Users" - }, - { - "action": "business.disable_open_scim", - "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "Configuring OIDC for Enterprise Managed Users" + }, + { + "action": "business.disable_open_scim", + "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1516,18 +2337,31 @@ "description": "SAML single sign-on was disabled for an enterprise.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "business", + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "user_agent", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "_document_id", "issuer", - "@timestamp", - "actor_id", "name", "sso_url" ] @@ -1537,17 +2371,28 @@ "description": "Display of IP addresses within audit log events for the enterprise was disabled.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1558,18 +2403,31 @@ "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.", "docs_reference_links": "N/A", "fields": [ - "action", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "business_id", - "actor_id", - "name", - "_document_id", - "request_id" + "name" ] }, { @@ -1577,15 +2435,28 @@ "description": "OIDC single sign-on was enabled for an enterprise.", "docs_reference_links": "/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/configuring-oidc-for-enterprise-managed-users", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -1596,15 +2467,28 @@ "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1614,20 +2498,33 @@ "description": "SAML single sign-on was enabled for an enterprise.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "name", - "sso_url", "@timestamp", - "issuer", - "action", - "actor_id", "_document_id", - "request_id", - "created_at", + "action", "actor", - "business_id", + "actor_id", "business", - "user_agent" + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "sso_url", + "issuer", + "created_at" ] }, { @@ -1635,17 +2532,28 @@ "description": "Display of IP addresses within audit log events for the enterprise was enabled.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1656,18 +2564,31 @@ "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "operation_type", - "created_at", + "actor_id", "business", "business_id", - "name", - "_document_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "name" ] }, { @@ -1675,19 +2596,30 @@ "description": "A GitHub Enterprise Server license was downloaded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", "business", - "user_agent", - "action", - "request_id", - "user", "business_id", - "_document_id", - "actor_id", - "operation_type", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -1695,12 +2627,29 @@ "description": "The trial of GitHub Enterprise Cloud expired.", "docs_reference_links": "/admin/overview/setting-up-a-trial-of-github-enterprise-cloud", "fields": [ - "name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type" ], @@ -1711,17 +2660,29 @@ "description": "GitHub Models billing was disabled for the business.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type", "actor_is_bot" @@ -1732,17 +2693,29 @@ "description": "GitHub Models billing was enabled for the business.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type", "actor_is_bot" @@ -1753,18 +2726,31 @@ "description": "License usage information was imported from a GitHub Enterprise Server instance to an enterprise account on GitHub.com.", "docs_reference_links": "/billing/managing-your-license-for-github-enterprise/syncing-license-usage-between-github-enterprise-server-and-github-enterprise-cloud#manually-uploading-github-enterprise-server-license-usage", "fields": [ - "name", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", "business_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type", - "business", - "action", - "@timestamp", - "_document_id", - "actor_id" + "name", + "created_at", + "operation_type" ], "docs_reference_titles": "Syncing license usage from GitHub Enterprise Server to Cloud" }, @@ -1773,19 +2759,30 @@ "description": "An invitation for someone to be an enterprise owner of an enterprise was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "name", - "request_id", + "actor", + "actor_id", "business", - "invitation_id", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "actor", - "actor_id", - "_document_id", - "@timestamp", - "user", + "name", + "invitation_id", "operation_type", "created_at" ] @@ -1795,20 +2792,31 @@ "description": "An invitation for someone to be a billing manager of an enterprise was sent.", "docs_reference_links": "N/A", "fields": [ - "user", - "operation_type", - "user_agent", - "invitation_id", + "@timestamp", "_document_id", - "business", - "actor", - "user_id", "action", - "@timestamp", - "name", - "request_id", + "actor", "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "invitation_id", + "name", "created_at" ] }, @@ -1817,19 +2825,31 @@ "description": "An invitation for someone to join an enterprise was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "invitation_id", "email", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1840,20 +2860,31 @@ "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", "actor_id", - "@timestamp", - "request_id", "business", - "name", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "business_id", - "_document_id" + "created_at", + "name", + "operation_type" ] }, { @@ -1861,20 +2892,31 @@ "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" + "user_agent", + "name", + "operation_type", + "created_at" ] }, { @@ -1882,20 +2924,31 @@ "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "name", - "actor", - "operation_type", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "business", - "actor_id", - "created_at", - "action", + "user_id", "user_agent", - "request_id", - "user_id" + "name", + "operation_type", + "created_at" ] }, { @@ -1903,19 +2956,31 @@ "description": "An enterprise has reached its members limit.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "limit", "count", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1926,19 +2991,31 @@ "description": "An enterprise is approaching its organizations limit.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "limit", "count", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1949,16 +3026,28 @@ "description": "The proxy security header was disabled for an enterprise. All users on the network can now access GitHub, unless blocked by other means.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1969,15 +3058,28 @@ "description": "The proxy security header was enabled for an enterprise. When the header is provided in requests, only Enterprise Managed Users matching the header will be able to access GitHub.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1988,15 +3090,29 @@ "description": "A user outside the enterprise tried to access GitHub while the proxy security header was enabled and provided in the request.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "programmatic_access_type", - "name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type", "actor_is_bot" @@ -2007,17 +3123,30 @@ "description": "An enterprise owner failed to sign into a enterprise with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/accessing-your-enterprise-account-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "reason", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2028,16 +3157,29 @@ "description": "An enterprise owner successfully signed into an enterprise with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/accessing-your-enterprise-account-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type" ], @@ -2048,19 +3190,31 @@ "description": "An enterprise owner downloaded the enterprise's SSO recovery codes.", "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/downloading-your-enterprise-accounts-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Downloading your enterprise account's single sign-on recovery codes" }, @@ -2069,39 +3223,64 @@ "description": "An enterprise owner generated the enterprise's SSO recovery codes.", "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/downloading-your-enterprise-accounts-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Downloading your enterprise account's single sign-on recovery codes" - }, - { - "action": "business.recovery_codes_printed", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "operation_type" + ], + "docs_reference_titles": "Downloading your enterprise account's single sign-on recovery codes" + }, + { + "action": "business.recovery_codes_printed", "description": "An enterprise owner printed the enterprise's SSO recovery codes.", "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/downloading-your-enterprise-accounts-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Downloading your enterprise account's single sign-on recovery codes" }, @@ -2110,16 +3289,29 @@ "description": "An enterprise owner viewed the enterprise's SSO recovery codes.", "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/downloading-your-enterprise-accounts-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type" ], @@ -2130,20 +3322,31 @@ "description": "An enterprise owner was removed from an enterprise.", "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", - "user_agent", + "actor_id", "business", "business_id", - "@timestamp", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "name", - "actor_id", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", - "user" + "user_agent", + "operation_type", + "created_at", + "name" ], "docs_reference_titles": "Inviting people to manage your enterprise" }, @@ -2152,19 +3355,30 @@ "description": "A billing manager was removed from an enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", "business", - "actor", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "request_id", - "action", - "_document_id", "operation_type", - "@timestamp", "name", - "business_id", - "user", "created_at" ] }, @@ -2173,20 +3387,30 @@ "description": "Removed a two-factor authentication method restriction for an enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", - "two_factor_method", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "two_factor_method", "created_at", "operation_type", "actor_is_bot" @@ -2197,20 +3421,30 @@ "description": "A member was removed from an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", "@timestamp", - "business_id", - "actor_id", + "_document_id", + "action", "actor", - "operation_type", - "user", - "created_at", + "actor_id", "business", - "user_id", - "action", - "_document_id", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2218,20 +3452,31 @@ "description": "An organization was removed from an enterprise.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "business", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "business_id", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "name", - "org" + "name" ] }, { @@ -2239,20 +3484,31 @@ "description": "A support entitlement was removed from a member of an enterprise.", "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/managing-support-entitlements-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing support entitlements for your enterprise" }, @@ -2261,38 +3517,63 @@ "description": "The slug for the enterprise URL was renamed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "name", - "business_id", - "user_agent", - "action", - "actor_id", - "operation_type", - "actor", "@timestamp", - "created_at", - "business", - "_document_id" - ] - }, - { - "action": "business.restore", - "description": "The deleted enterprise was restored.", - "docs_reference_links": "N/A", - "fields": [ + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "request_access_security_header" + "created_at" + ] + }, + { + "action": "business.restore", + "description": "The deleted enterprise was restored.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "operation_type" ] }, { @@ -2300,20 +3581,31 @@ "description": "The external identity for a member in an enterprise was revoked.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", "_document_id", - "user_id", - "operation_type", + "action", "actor", - "created_at", - "name", - "user_agent", "actor_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "business" + "user_id", + "user_agent", + "operation_type", + "created_at", + "name" ] }, { @@ -2321,20 +3613,31 @@ "description": "The SAML single sign-on session for a member in an enterprise was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", - "user_agent", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "actor", - "_document_id", - "actor_id", "name", - "@timestamp", - "user_id", - "action", - "created_at", - "business" + "created_at" ] }, { @@ -2342,15 +3645,28 @@ "description": "Enablement for Secret Protection features on new repositories has been locked for this enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -2361,15 +3677,28 @@ "description": "Enablement for Secret Protection features on new repositories has been unlocked for this enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -2380,17 +3709,28 @@ "description": "Automatic partner validation checks have been disabled at the business level", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -2401,17 +3741,28 @@ "description": "Automatic partner validation checks have been enabled at the business level", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -2422,20 +3773,30 @@ "description": "An enterprise-level custom pattern was created for secret scanning.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -2444,17 +3805,28 @@ "description": "An enterprise-level custom pattern was removed from secret scanning.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -2464,20 +3836,30 @@ "description": "An enterprise-level custom pattern was published for secret scanning.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2485,17 +3867,28 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -2506,20 +3899,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -2528,17 +3931,28 @@ "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -2548,17 +3962,28 @@ "description": "Secret scanning was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -2569,17 +3994,28 @@ "description": "Secret scanning was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -2590,17 +4026,28 @@ "description": "Secret scanning was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -2611,17 +4058,28 @@ "description": "Secret scanning was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -2632,17 +4090,28 @@ "description": "Generic secrets have been disabled at the business level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -2653,21 +4122,31 @@ "description": "Generic secrets have been enabled at the business level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -2675,17 +4154,28 @@ "description": "Secret scanning for non-provider patterns was disabled at the enterprise level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -2697,17 +4187,28 @@ "description": "Secret scanning for non-provider patterns was enabled at the enterprise level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -2719,17 +4220,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -2740,17 +4252,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -2761,17 +4284,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -2782,17 +4316,28 @@ "description": "Push protection for secret scanning was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -2803,17 +4348,28 @@ "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -2824,17 +4380,28 @@ "description": "Push protection for secret scanning was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -2845,17 +4412,28 @@ "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -2866,10 +4444,28 @@ "description": "The push protection setting was updated for a secret type for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "push_protection_setting", "secret_type", "secret_type_display_name", @@ -2882,10 +4478,28 @@ "description": "The push protection pattern configuration was updated for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" @@ -2895,20 +4509,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2916,26 +4542,36 @@ "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -2943,24 +4579,34 @@ "description": "A CSV export was requested on the \"Coverage\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -2968,26 +4614,36 @@ "description": "A CSV export was requested on the \"Overview Dashboard\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -2995,20 +4651,31 @@ "description": "A CSV export was requested on the \"Risk\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3019,17 +4686,29 @@ "description": "The cache retention policy for GitHub Actions was set for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type", "actor_is_bot" @@ -3041,17 +4720,29 @@ "description": "The cache storage policy for GitHub Actions was set for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type", "actor_is_bot" @@ -3063,17 +4754,30 @@ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "created_at", "operation_type" ], @@ -3084,20 +4788,32 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -3106,19 +4822,32 @@ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "limit", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -3127,19 +4856,31 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -3148,20 +4889,32 @@ "description": "The policy for fork pull request workflows was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -3170,19 +4923,31 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -3191,20 +4956,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "issuer", - "name", - "user_agent", - "action", "@timestamp", "_document_id", + "action", "actor", + "actor_id", "business", "business_id", - "actor_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "issuer", + "name", + "created_at", + "operation_type" ] }, { @@ -3212,18 +4989,31 @@ "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "updated_github_owned_allowed", "updated_verified_allowed", "updated_patterns", @@ -3238,20 +5028,33 @@ "description": "The base repository permission setting was updated for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", "fields": [ - "business_id", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "permission", - "action", "created_at", - "@timestamp", - "request_id", "name", - "_document_id", - "old_permission", - "business" + "old_permission" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3260,18 +5063,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "old_emu_repo_runners_policy", "new_emu_repo_runners_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3281,19 +5097,32 @@ "description": "The repository creation setting was updated for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation", "fields": [ - "created_at", + "@timestamp", "_document_id", - "request_id", - "name", - "business_id", + "action", "actor", "actor_id", - "@timestamp", - "operation_type", - "permission", - "action", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "name", + "operation_type", + "permission", "visibility" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -3303,19 +5132,32 @@ "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories", "fields": [ - "business_id", - "created_at", - "action", - "operation_type", "@timestamp", - "request_id", - "permission", + "_document_id", + "action", "actor", "actor_id", - "name", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "business" + "created_at", + "operation_type", + "permission", + "name" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3324,18 +5166,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "old_repo_runners_policy", "new_repo_runners_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3345,41 +5200,64 @@ "description": "The SAML single sign-on provider settings for an enterprise were updated.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", "_document_id", - "request_id", - "business_id", - "sso_url", - "user_agent", "action", - "business", - "name", - "created_at", - "operation_type", + "actor", "actor_id", - "@timestamp", - "issuer" - ] - }, - { - "action": "business.upgrade_from_organization", - "description": "The organization was upgraded to an enterprise account.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/upgrading-your-accounts-plan#upgrading-your-organizations-plan", - "fields": [ - "actor", - "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "name", "created_at", "operation_type", + "issuer" + ] + }, + { + "action": "business.upgrade_from_organization", + "description": "The organization was upgraded to an enterprise account.", + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/upgrading-your-accounts-plan#upgrading-your-organizations-plan", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "request_access_security_header" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Upgrading your account's plan" }, @@ -3388,20 +5266,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -3410,20 +5299,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -3434,17 +5334,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3452,15 +5364,31 @@ "description": "Existing code scanning alerts appeared in a branch.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -3470,15 +5398,31 @@ "description": "Code scanning alerts were fixed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -3488,15 +5432,31 @@ "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_numbers", "commit_oid", - "ref", - "request_id", - "org_id", - "org", - "business_id", - "business" + "ref" ], "docs_reference_titles": "About code scanning" }, @@ -3505,15 +5465,29 @@ "description": "Code scanning alerts were manually dismissed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers", "dismissal_approver_id" ], @@ -3524,19 +5498,31 @@ "description": "Dismissal of code scanning alerts was approved.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "dismissal_request_id", - "alert_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", - "action", - "_document_id", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismissal_request_id", + "alert_number", + "public_repo", "created_at", "operation_type" ], @@ -3547,19 +5533,31 @@ "description": "Dismissal of code scanning alerts was denied.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3570,19 +5568,31 @@ "description": "Dismissal of code scanning alerts was requested.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3593,13 +5603,31 @@ "description": "Code scanning alerts were seen for the first time.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -3609,15 +5637,31 @@ "description": "Code scanning alerts that were previously fixed reappeared.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -3627,15 +5671,29 @@ "description": "Code scanning alerts that were previously dismissed were reopened.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -3645,14 +5703,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3662,28 +5735,34 @@ "description": "An attempt to create a codespace from a prebuild was made.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "owner", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "user_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_id", + "user_agent", + "name", + "owner", + "pull_request_id", "created_at", "operation_type", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -3691,17 +5770,30 @@ "description": "Enterprise setting for Codespaces ownership was updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enablement", "organization_names", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3712,25 +5804,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -3741,22 +5842,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -3768,22 +5880,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -3792,15 +5915,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -3811,15 +5949,28 @@ "description": "Policies were applied to codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -3829,20 +5980,30 @@ "description": "Policies were removed from codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -3850,19 +6011,30 @@ "description": "Policies were updated for codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -3870,17 +6042,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3890,27 +6075,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "org", "owner", "pull_request_id", "machine_type", - "user_id", - "user", "devcontainer_path", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3918,19 +6112,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -3938,40 +6145,62 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ], - "docs_reference_titles": "Managing access to other repositories within your codespace" - }, - { - "action": "commit_comment.destroy", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Managing access to other repositories within your codespace" + }, + { + "action": "commit_comment.destroy", "description": "A commit comment was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "repo", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "created_at", - "@timestamp", - "operation_type", + "programmatic_access_type", + "repo", "repo_id", - "actor_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "programmatic_access_type" + "created_at", + "operation_type" ] }, { @@ -3979,21 +6208,30 @@ "description": "A commit comment was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "repo_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_id", - "action", - "@timestamp", - "repo", "org_id", - "actor_id", - "created_at", - "user_agent", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -4001,21 +6239,33 @@ "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "reason", "plan", - "org_id", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4023,17 +6273,30 @@ "description": "The Copilot enablement policy changed at the enterprise level to either allow or disable access for all organizations, or to allow access for selected organizations.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "previous_value", "current_value", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -4044,15 +6307,28 @@ "description": "Copilot feature settings were changed at the enterprise level.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4062,13 +6338,28 @@ "description": "Copilot feature settings were changed at the organization level.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4078,23 +6369,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -4102,16 +6400,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -4120,24 +6432,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -4145,15 +6463,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4163,20 +6494,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -4184,19 +6525,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -4204,21 +6557,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -4226,21 +6588,33 @@ "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_value", "new_value", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4248,15 +6622,28 @@ "description": "The GitHub Copilot Product Terms or Pre-Release Preview Terms were accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4266,21 +6653,32 @@ "description": "The excluded paths for GitHub Copilot were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "excluded_paths", "owner_type", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -4288,17 +6686,30 @@ "description": "Copilot access was enabled or disabled at the enterprise level.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "previous_value", "current_value", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4308,17 +6719,30 @@ "description": "The plan for GitHub Copilot was updated.", "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_plan", "plan", - "business_id", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -4330,20 +6754,31 @@ "description": "The plan for GitHub Copilot was scheduled to be downgraded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "current_plan", "scheduled_plan" @@ -4354,21 +6789,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -4378,19 +6822,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4400,21 +6853,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -4424,18 +6886,31 @@ "description": "A new custom property definition was created.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -4448,18 +6923,31 @@ "description": "A custom property definition was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -4473,14 +6961,29 @@ "description": "A custom property definition was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "value_type", @@ -4493,8 +6996,7 @@ "old_default_value", "old_value_type", "old_values_editable_by", - "values_editable_by", - "request_access_security_header" + "values_editable_by" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -4503,27 +7005,35 @@ "description": "A repository's custom property value was manually set for the first time.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -4532,19 +7042,31 @@ "description": "A repository's custom property value was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -4553,16 +7075,29 @@ "description": "A repository's custom property value was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "definition_id" @@ -4574,40 +7109,62 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -4616,19 +7173,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -4637,19 +7205,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -4658,25 +7237,33 @@ "description": "Dismissal of Dependabot alerts was approved.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -4686,25 +7273,33 @@ "description": "Dismissal request for Dependabot alerts was canceled.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -4714,25 +7309,33 @@ "description": "Dismissal of Dependabot alerts was requested.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -4742,25 +7345,33 @@ "description": "Dismissal of Dependabot alerts was denied.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -4770,21 +7381,31 @@ "description": "The default repository access for Dependabot was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "access_level", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -4793,17 +7414,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4811,19 +7445,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -4832,19 +7477,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -4852,19 +7508,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -4873,19 +7540,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -4893,19 +7571,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -4914,19 +7603,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -4934,19 +7634,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -4955,20 +7666,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -4976,21 +7697,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", - "repo_id", - "request_id", + "@timestamp", + "_document_id", "action", "actor", - "org_id", - "_document_id", "actor_id", - "operation_type", - "@timestamp", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4998,20 +7728,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo_id", "@timestamp", - "actor", - "user_agent", - "request_id", - "org", "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "repo", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5019,22 +7759,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "user_agent", - "actor_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "title", - "_document_id", - "created_at", - "repo", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -5042,17 +7791,31 @@ "description": "A global announcement banner was created for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -5063,16 +7826,30 @@ "description": "A global announcement banner was removed from the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -5083,18 +7860,32 @@ "description": "A global announcement banner was updated for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", "old_message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -5105,23 +7896,31 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise" }, @@ -5130,19 +7929,33 @@ "description": "A domain was approved for an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -5151,18 +7964,33 @@ "description": "A domain was added to an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -5171,18 +7999,33 @@ "description": "A domain was removed from an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -5191,18 +8034,33 @@ "description": "A domain was verified for an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -5211,17 +8069,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was created.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", - "operation_type", "@timestamp", "_document_id", - "org_id", "action", - "request_id", - "org", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -5230,17 +8101,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was deleted.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", + "@timestamp", "_document_id", "action", - "@timestamp", - "actor_id", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -5249,18 +8133,30 @@ "description": "A new GitHub Actions self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -5269,20 +8165,30 @@ "description": "A GitHub Actions self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -5291,20 +8197,30 @@ "description": "An enterprise role was assigned to a user or enterprise team.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "enterprise_role_id", - "enterprise_role_name", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "enterprise_role_id", + "enterprise_role_name", "created_at", "operation_type", "actor_is_bot" @@ -5316,20 +8232,32 @@ "description": "A custom enterprise role was created in an enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -5341,20 +8269,32 @@ "description": "A custom enterprise role was deleted in an enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -5366,20 +8306,30 @@ "description": "A user or enterprise team was unassigned an enterprise role.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "request_access_security_header", "enterprise_role_id", "enterprise_role_name", - "business", - "business_id", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -5391,21 +8341,33 @@ "description": "A custom enterprise role was edited in an enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", "old_role_permissions", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -5417,18 +8379,31 @@ "description": "A GitHub Actions self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows" ], "docs_reference_titles": "Removing self-hosted runners" @@ -5438,18 +8413,31 @@ "description": "A GitHub Actions self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -5458,18 +8446,31 @@ "description": "A GitHub Actions self-hosted runner group was renamed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -5478,20 +8479,33 @@ "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -5500,19 +8514,31 @@ "description": "A GitHub Actions self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -5521,19 +8547,32 @@ "description": "A GitHub Actions runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -5542,24 +8581,36 @@ "description": "The configuration of a GitHub Actions self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -5568,19 +8619,32 @@ "description": "The visibility of a GitHub Actions self-hosted runner group was updated via the REST API.", "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", - "visibility", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" }, @@ -5589,14 +8653,32 @@ "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -5605,14 +8687,32 @@ "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -5621,18 +8721,36 @@ "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", "target_version", "runner_group_id", "runner_group_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Self-hosted runners" }, @@ -5641,22 +8759,32 @@ "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "business_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "user", - "business", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5664,21 +8792,33 @@ "description": "A license for GitHub Copilot was assigned to an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5686,17 +8826,30 @@ "description": "A license for GitHub Copilot was unassigned from an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -5707,17 +8860,30 @@ "description": "A new enterprise team was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5727,17 +8893,30 @@ "description": "An enterprise team was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -5748,22 +8927,32 @@ "description": "A member was removed from the enterprise team or an IdP group linked to an enterprise team, or an IdP group was unlinked from an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "business_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "user", - "business", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5771,18 +8960,31 @@ "description": "The name of an enterprise team was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "business_id", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -5793,22 +8995,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -5817,22 +9028,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5840,28 +9061,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -5870,27 +9097,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -5899,25 +9134,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -5926,26 +9169,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -5954,21 +9204,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5977,22 +9239,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -6001,25 +9273,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -6028,22 +9309,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -6052,21 +9345,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -6077,27 +9380,33 @@ "description": "A user was added to an external group.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "external_group", - "external_group_id", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "external_group", + "external_group_id", "created_at", "operation_type", - "business", - "business_id", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -6105,19 +9414,31 @@ "description": "An external group was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at", "scim_group_id" ] }, @@ -6126,22 +9447,33 @@ "description": "An external group was linked to a GitHub team.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "external_group", - "programmatic_access_type", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -6149,21 +9481,31 @@ "description": "An external group was created.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -6171,26 +9513,32 @@ "description": "A user was removed from an external group.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "external_group", - "external_group_id", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "external_group", + "external_group_id", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -6198,15 +9546,29 @@ "description": "Failed external group SCIM API request.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", @@ -6214,15 +9576,9 @@ "url_path", "scim_group_id", "message", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "created_at", + "operation_type", + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -6231,30 +9587,38 @@ "description": "Successful external group SCIM API request. Excludes GET API requests.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", "status_code", "url_path", "scim_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -6263,18 +9627,31 @@ "description": "An external group was unlinked to a GitHub team.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "external_group" ] }, @@ -6283,22 +9660,32 @@ "description": "An external group was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "scim_group_id", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at", + "scim_group_id" ] }, { @@ -6306,25 +9693,33 @@ "description": "An external group's display name was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", "external_group", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -6332,20 +9727,31 @@ "description": "An external identity was deprovisioned, suspending the linked GitHub user.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -6353,17 +9759,31 @@ "description": "An external identity was created and linked to a GitHub user.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "scim_user_id", - "request_access_security_header" + "scim_user_id" ] }, { @@ -6371,15 +9791,29 @@ "description": "Failed external identity SCIM API request.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", @@ -6387,15 +9821,9 @@ "url_path", "scim_user_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -6404,30 +9832,38 @@ "description": "Successful external identity SCIM API request. Excludes GET API requests.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", "status_code", "url_path", "scim_user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -6436,18 +9872,31 @@ "description": "An external identity was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "scim_user_id", - "request_access_security_header" + "scim_user_id" ] }, { @@ -6455,19 +9904,30 @@ "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -6476,20 +9936,30 @@ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -6498,19 +9968,30 @@ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -6519,23 +10000,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -6543,18 +10033,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -6565,20 +10065,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -6588,25 +10098,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -6614,25 +10134,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -6640,26 +10169,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -6668,25 +10206,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -6694,26 +10241,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -6721,21 +10277,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -6744,19 +10311,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -6764,21 +10344,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -6787,19 +10378,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -6810,20 +10415,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -6833,24 +10450,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -6861,23 +10489,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -6888,21 +10528,33 @@ "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", "operation_type", - "@timestamp", "integration", - "action", - "user_agent", "reason", - "_document_id", - "org", - "org_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -6913,20 +10565,32 @@ "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ "@timestamp", - "actor_id", - "org", "_document_id", - "requester", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "requester", "created_at", "url", - "org_id", - "request_id", "operation_type", - "actor", "integration", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -6936,20 +10600,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -6959,19 +10636,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -6980,20 +10671,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -7003,20 +10707,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -7025,20 +10742,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -7047,20 +10777,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -7068,19 +10810,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -7089,19 +10844,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -7110,17 +10878,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -7133,21 +10914,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -7161,17 +10955,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -7183,19 +10990,30 @@ "description": "An IP allow list was disabled.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "actor", - "request_id", - "org", - "user_agent", + "@timestamp", "_document_id", - "user_id", + "action", + "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "@timestamp", - "user" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7203,19 +11021,30 @@ "description": "An IP allow list was disabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7223,15 +11052,28 @@ "description": "Identity Provider based IP allow list for web interactions was disabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -7242,15 +11084,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7260,17 +11115,28 @@ "description": "IP allow list user level enforcement was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7280,20 +11146,29 @@ "description": "An IP allow list was enabled.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "user_id", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "business_id", - "_document_id", - "action", - "@timestamp", + "user_id", "user_agent", - "actor_id", "operation_type", - "org", "created_at" ] }, @@ -7302,19 +11177,30 @@ "description": "An IP allow list was enabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7322,15 +11208,28 @@ "description": "Identity Provider based IP allow list for web interactions was enabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -7341,15 +11240,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7359,17 +11271,28 @@ "description": "IP allow list user level enforcement was enabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7379,24 +11302,32 @@ "description": "An IP address was added to an IP allow list.", "docs_reference_links": "N/A", "fields": [ - "active", - "org", - "ip_allow_list_entry", "@timestamp", "_document_id", - "operation_type", - "created_at", - "user_agent", "action", - "request_id", + "actor", "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "business", - "actor", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", + "ip_allow_list_entry", + "operation_type", + "created_at" ] }, { @@ -7404,24 +11335,32 @@ "description": "An IP address was deleted from an IP allow list.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "ip_allow_list_entry", - "org", - "operation_type", - "created_at", - "active", "action", - "@timestamp", + "actor", + "actor_id", "business", "business_id", - "user_agent", + "hashed_token", + "org", "org_id", - "actor", - "actor_id", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ip_allow_list_entry", + "operation_type", + "created_at", + "active" ] }, { @@ -7429,19 +11368,32 @@ "description": "An IP address or its description was changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "actor_id", "ip_allow_list_entry", - "active", - "org_id", - "@timestamp" + "active" ] }, { @@ -7449,15 +11401,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7467,47 +11432,62 @@ "description": "A comment on an issue was deleted from the repository.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "org", - "repo", - "actor_id", "@timestamp", - "created_at", "_document_id", "action", - "operation_type", - "user_agent", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "oauth_application_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { "action": "issue_comment.pinned", "description": "A comment on an issue was pinned to a repository.", "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "hashed_token", - "programmatic_access_type", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -7518,19 +11498,29 @@ "description": "A comment on an issue was unpinned from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -7541,22 +11531,31 @@ "description": "A comment on an issue (other than the initial one) changed.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", - "action", - "repo_id", - "org_id", - "created_at", - "operation_type", "@timestamp", - "user_agent", - "request_id", "_document_id", - "actor_id", + "action", "actor", - "oauth_application_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -7564,21 +11563,31 @@ "description": "An issue was deleted from the repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", "fields": [ - "user", - "actor_id", - "created_at", - "title", "@timestamp", "_document_id", - "request_id", - "actor", - "user_id", "action", - "operation_type", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "title", + "operation_type" ], "docs_reference_titles": "Deleting an issue" }, @@ -7587,23 +11596,33 @@ "description": "An issue was pinned to a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ + "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", "action", "actor", - "operation_type", - "owner_type", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "number", - "repo", - "event", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type", + "owner_type", + "number", + "event" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -7612,22 +11631,32 @@ "description": "An issue was transferred to another repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "owner_type", - "actor_id", "number", - "repo", "operation_type", - "_document_id", - "repo_id", - "action", - "request_id", - "created_at", - "actor", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Transferring an issue to another repository" }, @@ -7636,24 +11665,33 @@ "description": "An issue was unpinned from a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ - "event", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", - "action", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "operation_type", - "_document_id", - "number", - "owner_type", - "@timestamp", + "token_id", + "token_scopes", "user", "user_id", - "token_scopes", - "request_access_security_header" + "user_agent", + "event", + "created_at", + "operation_type", + "number", + "owner_type" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -7662,19 +11700,30 @@ "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user_agent", - "action", "@timestamp", - "operation_type", - "request_id", - "actor_id", - "user_id", - "created_at", "_document_id", + "action", "actor", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "org_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -7683,18 +11732,29 @@ "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -7704,19 +11764,30 @@ "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user", - "request_id", - "actor", - "business_id", - "action", - "operation_type", - "user_agent", - "created_at", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor_id" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -7725,18 +11796,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7744,21 +11827,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -7766,21 +11862,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -7788,22 +11897,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -7811,19 +11933,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -7833,22 +11968,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -7856,22 +12004,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7879,20 +12040,30 @@ "description": "The ability for members to publish GitHub Pages sites was disabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -7900,21 +12071,31 @@ "action": "members_can_create_pages.enable", "description": "The ability for members to publish GitHub Pages sites was enabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", - "fields": [ - "user_agent", - "request_id", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -7923,21 +12104,30 @@ "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -7946,22 +12136,30 @@ "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -7970,19 +12168,30 @@ "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "operation_type", "user_agent", - "actor", - "actor_id", - "business_id", - "@timestamp", - "created_at", - "action" + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -7991,18 +12200,29 @@ "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "request_id", - "org", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "actor", "operation_type", - "org_id", - "action", - "@timestamp", "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -8012,21 +12232,30 @@ "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "action", - "org_id", - "user_id", - "business", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business_id", + "user_id", + "user_agent", "created_at", - "actor", - "org", - "operation_type", - "user_agent" + "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -8037,16 +12266,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -8055,21 +12295,30 @@ "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "created_at", - "user_id", "business_id", - "user", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "org_id", - "@timestamp" + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -8078,19 +12327,30 @@ "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ - "request_id", - "created_at", - "_document_id", - "user_agent", - "user", - "user_id", - "business", - "business_id", - "operation_type", "@timestamp", + "_document_id", "action", "actor", - "actor_id" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -8099,19 +12359,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8119,21 +12391,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8143,16 +12424,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8162,18 +12456,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8183,14 +12490,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -8198,19 +12521,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -8218,18 +12552,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8237,23 +12583,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -8261,16 +12615,30 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "org_id", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8278,24 +12646,32 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", - "repo_id", "operation_type", - "@timestamp", - "user_agent", "created_at", - "org", - "action", - "_document_id", - "repo", - "actor", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8303,15 +12679,28 @@ "description": "A network configuration for a hosted compute service was created.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -8329,15 +12718,28 @@ "description": "A network configuration for a hosted compute service was deleted.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -8350,15 +12752,28 @@ "description": "A network configuration for a hosted compute service was updated.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -8375,20 +12790,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -8397,20 +12824,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -8419,20 +12858,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -8441,20 +12892,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -8463,19 +12926,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -8484,20 +12960,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -8506,20 +12994,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -8528,19 +13028,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -8549,17 +13062,28 @@ "description": "An invitation sent to an organization to join an enterprise was accepted.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -8570,20 +13094,30 @@ "description": "A billing manager was added to an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "org", - "user_id", "action", - "created_at", - "org_id", - "user", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" }, @@ -8592,21 +13126,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -8615,24 +13159,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8640,21 +13194,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -8662,20 +13226,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -8683,22 +13257,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -8706,20 +13288,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8727,22 +13319,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -8750,21 +13350,31 @@ "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "new_policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "new_policy", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -8774,19 +13384,30 @@ "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -8795,19 +13416,30 @@ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -8817,17 +13449,30 @@ "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", "fields": [ - "org_id", - "operation_type", "@timestamp", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" }, @@ -8836,21 +13481,32 @@ "description": "An export of the organization's Git events was created.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "start", "end", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" }, @@ -8859,16 +13515,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_agent", - "action", "@timestamp", - "actor_id", - "org_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -8877,18 +13546,31 @@ "description": "An organization owner blocked a user from accessing the organization's repositories.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", "fields": [ - "actor", - "user_agent", - "org_id", - "created_at", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "blocked_user", + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" }, @@ -8897,19 +13579,30 @@ "description": "An invitation for an organization to join an enterprise was revoked", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "initiated_from" ], "docs_reference_titles": "Adding organizations to your enterprise" @@ -8919,22 +13612,33 @@ "description": "An invitation sent to a user to join an organization was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "email", - "@timestamp", - "actor", - "action", "operation_type", - "user_agent", - "org", "invitation_id", - "_document_id", "created_at", - "invitee_email", - "token_scopes", - "programmatic_access_type" + "invitee_email" ] }, { @@ -8942,19 +13646,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -8962,23 +13677,31 @@ "description": "Autofix for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8986,21 +13709,31 @@ "description": "Autofix for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9008,23 +13741,31 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9032,23 +13773,31 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9056,21 +13805,30 @@ "description": "Code scanning using the default setup was disabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -9079,21 +13837,30 @@ "description": "Code scanning using the default setup was enabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -9102,20 +13869,31 @@ "description": "Access to use Codespaces on internal and private repositories was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "enablement", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "enablement", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization" }, @@ -9124,21 +13902,31 @@ "description": "Ownership and payment for codespaces was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "owner_type", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" }, @@ -9147,16 +13935,29 @@ "description": "A team has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9166,16 +13967,29 @@ "description": "A team has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9185,19 +13999,30 @@ "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -9206,17 +14031,30 @@ "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -9225,21 +14063,30 @@ "description": "A user has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -9247,21 +14094,30 @@ "description": "A user has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -9269,16 +14125,29 @@ "description": "The interaction limit for collaborators only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "request_id", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" @@ -9288,17 +14157,30 @@ "description": "The interaction limit for prior contributors only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "operation_type", "@timestamp", - "created_at", - "user_agent", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", - "actor", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -9307,17 +14189,30 @@ "description": "The interaction limit for existing users only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", "_document_id", - "operation_type", - "actor_id", - "org_id", "action", - "created_at", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -9327,16 +14222,29 @@ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ "@timestamp", - "created_at", "_document_id", - "actor_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "action", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -9345,17 +14253,30 @@ "description": "The interaction limit for prior contributors only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "operation_type", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "org", - "created_at", - "_document_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -9364,17 +14285,30 @@ "description": "The interaction limit for existing users only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "actor_id", - "request_id", + "@timestamp", + "_document_id", "action", - "created_at", - "user_agent", "actor", - "_document_id", - "org_id", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -9383,22 +14317,30 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" }, @@ -9407,17 +14349,28 @@ "description": "An invitation for an organization to join an enterprise was confirmed.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -9428,18 +14381,30 @@ "description": "An organization was created.", "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", "fields": [ - "request_id", - "org", - "actor_id", - "actor", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "org_id", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" }, @@ -9448,20 +14413,31 @@ "description": "A GitHub Actions secret was created for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -9470,20 +14446,32 @@ "description": "A GitHub Actions variable was created for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -9492,21 +14480,33 @@ "description": "A Codespaces or Dependabot secret was created for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -9514,21 +14514,30 @@ "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor_id", - "org_id", - "business", - "action", "@timestamp", - "org", "_document_id", - "business_id", + "action", "actor", - "token_scopes", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "actor_is_bot", "oauth_credential_type", "managed_oauth_access_id", @@ -9544,24 +14553,32 @@ "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", "fields": [ - "user_agent", - "actor", "@timestamp", - "created_at", - "org_id", - "business_id", - "operation_type", - "request_id", "_document_id", "action", + "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", - "token_scopes", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot", "oauth_credential_type", - "request_access_security_header", "managed_oauth_access_id", "managed_token_id", "managed_oauth_scopes", @@ -9575,21 +14592,32 @@ "description": "An owner revoked authorized credentials.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "oauth_application_id", - "org_id", "operation_type", - "action", - "business", - "request_id", "created_at", - "business_id", - "actor_id", - "_document_id", - "user_agent", "oauth_credential_type", "managed_oauth_access_id", "managed_token_id", @@ -9604,18 +14632,30 @@ "description": "An organization was deleted by a user or staff.", "docs_reference_links": "N/A", "fields": [ - "user_agent", "@timestamp", "_document_id", - "created_at", - "actor", - "org_id", - "org", "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -9623,20 +14663,30 @@ "description": "Team creation was limited to owners.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "actor", "@timestamp", "_document_id", - "user", - "user_id", "action", - "created_at", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -9645,16 +14695,29 @@ "description": "Third-party application access restrictions for an organization were disabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "org_id", - "action", - "_document_id", - "request_id", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" @@ -9664,19 +14727,30 @@ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -9685,14 +14759,31 @@ "description": "SAML single sign-on was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sso_url", "issuer", - "action", - "@timestamp", - "_document_id", "created_at", - "org", "operation_type" ] }, @@ -9701,17 +14792,30 @@ "description": "A two-factor authentication requirement was disabled for the organization.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "org_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "_document_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -9719,19 +14823,30 @@ "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "user", - "action", - "operation_type", "@timestamp", "_document_id", - "created_at", - "user_agent", - "org", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9739,19 +14854,30 @@ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "user", - "action", - "actor_id", - "org_id" + "created_at" ] }, { @@ -9759,19 +14885,30 @@ "description": "Team creation by members was allowed.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "org_id", - "user", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -9780,17 +14917,30 @@ "description": "Third-party application access restrictions for an organization were enabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "operation_type", - "org", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" }, @@ -9799,19 +14949,30 @@ "description": "An organization owner allowed users with read access to create discussions in an organization", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -9820,19 +14981,32 @@ "description": "SAML single sign-on was enabled for the organization.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", - "sso_url", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "@timestamp", - "issuer", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "sso_url", + "created_at", + "issuer" ], "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" }, @@ -9841,17 +15015,30 @@ "description": "Two-factor authentication is now required for the organization.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "actor_id", - "action", - "_document_id", - "org", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" }, @@ -9860,17 +15047,30 @@ "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "org_id", - "manager", "@timestamp", - "request_id", - "actor", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "manager", + "operation_type", "created_at" ] }, @@ -9879,18 +15079,31 @@ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", "docs_reference_links": "N/A", "fields": [ - "org_id", "@timestamp", - "org", - "user_agent", - "request_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "manager", "operation_type", - "created_at", - "_document_id" + "created_at" ] }, { @@ -9898,23 +15111,32 @@ "description": "A new user was invited to join an organization.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", "fields": [ - "org", - "user_id", - "invitation_id", - "org_id", - "user", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", - "created_at", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "invitee_email", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitation_id", + "operation_type", + "created_at", + "invitee_email" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" }, @@ -9923,17 +15145,28 @@ "description": "An organization was invited to join an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -9943,19 +15176,30 @@ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -9963,19 +15207,30 @@ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent", - "actor_id", - "user_id", - "operation_type", - "@timestamp", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", - "actor", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9983,19 +15238,31 @@ "description": "Access to an organization was granted for an OAuth App.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "request_id", "actor_id", - "operation_type", - "org_id", - "_document_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" @@ -10005,20 +15272,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -10027,18 +15305,31 @@ "description": "Access was disabled for an OAuth App that was previously approved.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", "fields": [ - "request_id", - "url", - "created_at", - "org_id", - "action", "@timestamp", "_document_id", - "user_agent", - "org", - "operation_type", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", + "operation_type", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" @@ -10048,19 +15339,31 @@ "description": "An organization member requested that an owner grant an OAuth App access to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", + "@timestamp", "_document_id", - "request_id", - "url", - "org_id", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "url", "oauth_application_name" ] }, @@ -10069,20 +15372,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -10092,16 +15406,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "org_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type", - "_document_id", - "org" + "created_at", + "operation_type" ] }, { @@ -10109,20 +15436,31 @@ "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "reason", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "reason", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -10131,20 +15469,30 @@ "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -10153,19 +15501,30 @@ "description": "An organization owner downloaded the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -10174,19 +15533,30 @@ "description": "An organization owner generated the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -10195,19 +15565,30 @@ "description": "An organization owner printed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -10216,19 +15597,30 @@ "description": "An organization owner viewed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -10237,19 +15629,31 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", "fields": [ - "actor", - "operation_type", "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "actor_is_bot", - "request_access_security_header" + "operation_type", + "created_at", + "actor_is_bot" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -10258,20 +15662,31 @@ "description": "A GitHub Actions secret was removed from an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -10280,21 +15695,31 @@ "description": "A GitHub Actions variable was removed from an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -10303,18 +15728,29 @@ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "user_id", - "user_agent", - "org_id", - "user", - "action", - "_document_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" @@ -10324,22 +15760,32 @@ "description": "A Codespaces or Dependabot secret was removed from an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -10347,21 +15793,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -10369,21 +15824,30 @@ "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ - "org", - "user", - "org_id", - "created_at", - "request_id", "@timestamp", - "action", - "operation_type", - "user_agent", "_document_id", + "action", "actor", "actor_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -10391,21 +15855,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -10413,18 +15887,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", "fields": [ - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "actor", - "action", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -10433,19 +15919,31 @@ "description": "An organization was renamed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "_document_id", "@timestamp", - "org", + "_document_id", "action", "actor", - "old_login", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_login", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -10453,14 +15951,28 @@ "description": "Triggered when a required workflow is created.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -10471,14 +15983,28 @@ "description": "Triggered when a required workflow is deleted.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -10489,14 +16015,28 @@ "description": "Triggered when a required workflow is updated.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -10507,20 +16047,30 @@ "description": "An organization member was restored.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", "fields": [ - "user", - "actor", - "user_id", + "@timestamp", "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "actor_id", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" }, @@ -10529,21 +16079,33 @@ "description": "A self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" @@ -10553,21 +16115,31 @@ "description": "A self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "programmatic_access_type" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -10576,20 +16148,31 @@ "description": "A self-hosted runner group was renamed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -10598,23 +16181,33 @@ "description": "The REST API was used to remove a self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -10623,23 +16216,31 @@ "description": "A self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -10648,19 +16249,32 @@ "description": "A runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -10669,25 +16283,36 @@ "description": "The configuration of a self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -10696,21 +16321,32 @@ "description": "The visibility of a self-hosted runner group was updated via the REST API.", "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", - "visibility", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" }, @@ -10719,21 +16355,30 @@ "description": "Automatic partner validation checks have been disabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -10743,21 +16388,30 @@ "description": "Automatic partner validation checks have been enabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -10767,20 +16421,30 @@ "description": "A custom pattern was created for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -10789,22 +16453,30 @@ "description": "A custom pattern was removed from secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -10813,21 +16485,30 @@ "description": "A custom pattern was published for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -10836,21 +16517,30 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -10859,22 +16549,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -10883,21 +16581,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -10906,22 +16613,30 @@ "description": "Generic secrets have been disabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -10929,22 +16644,30 @@ "description": "Generic secrets have been enabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -10952,21 +16675,30 @@ "description": "Secret scanning for non-provider patterns was disabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -10976,21 +16708,30 @@ "description": "Secret scanning for non-provider patterns was enabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -11000,19 +16741,30 @@ "description": "A role or team was added to the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -11022,21 +16774,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -11046,21 +16807,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -11070,19 +16840,30 @@ "description": "A role or team was removed from the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -11092,22 +16873,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -11116,22 +16905,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -11140,22 +16937,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -11164,21 +16969,30 @@ "description": "Push protection for secret scanning was disabled.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -11187,21 +17001,30 @@ "description": "Push protection for secret scanning was enabled.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -11210,22 +17033,30 @@ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -11234,22 +17065,30 @@ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -11258,12 +17097,28 @@ "description": "The push protection setting was updated for a secret type for your organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "push_protection_setting", "secret_type", "secret_type_display_name", @@ -11276,12 +17131,28 @@ "description": "The push protection pattern configuration was updated for your organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at" ], "docs_reference_titles": "About push protection" @@ -11291,15 +17162,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -11308,15 +17196,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -11325,7 +17230,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -11340,18 +17266,28 @@ "description": "The cache retention policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -11363,18 +17299,28 @@ "description": "The cache storage policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -11386,20 +17332,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -11408,16 +17365,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -11428,18 +17398,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -11448,17 +17431,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", "_document_id", - "org_id", - "operation_type", + "action", "actor", "actor_id", - "@timestamp", - "request_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", - "action" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -11466,18 +17462,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -11486,18 +17494,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -11506,18 +17527,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -11526,22 +17559,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", "actor_id", - "org_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issuer", - "business", "operation_type", "created_at", - "request_id", - "business_id", - "_document_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11549,21 +17592,32 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Adding organizations to your enterprise" }, @@ -11572,19 +17626,30 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -11595,19 +17660,32 @@ "description": "A user was unblocked from an organization.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", "fields": [ - "oauth_application_id", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", - "@timestamp", - "request_id", - "created_at", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "blocked_user", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" }, @@ -11616,20 +17694,32 @@ "description": "A GitHub Actions secret was updated for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "created_at", "key", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -11638,23 +17728,34 @@ "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "updated_allowed_types", "old_policy", - "updated_access_policy", - "programmatic_access_type", - "request_access_security_header" + "updated_access_policy" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" }, @@ -11663,20 +17764,32 @@ "description": "A GitHub Actions variable was updated for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -11685,20 +17798,32 @@ "description": "The default repository permission level for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", + "created_at", "permission", - "actor_id", - "old_permission", - "_document_id", - "programmatic_access_type" + "old_permission" ] }, { @@ -11706,18 +17831,30 @@ "description": "The settings policy for immutable releases was updated for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_policy", "new_policy", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -11728,22 +17865,33 @@ "description": "A Codespaces or Dependabot secret was updated for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -11752,20 +17900,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -11773,17 +17932,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -11793,20 +17965,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -11815,17 +17998,30 @@ "description": "The name of the default branch was changed for new repositories in the organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" }, @@ -11834,19 +18030,32 @@ "description": "An organization's SAML provider settings were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "sso_url", - "actor_id", - "operation_type", - "@timestamp", - "issuer", - "org", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "operation_type", + "issuer", + "created_at" ] }, { @@ -11854,18 +18063,30 @@ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", "fields": [ - "request_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "_document_id", - "org", - "action", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" }, @@ -11874,11 +18095,28 @@ "description": "A new organization custom property definition was created.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "description", @@ -11886,11 +18124,6 @@ "required", "allowed_values", "default_value", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -11902,11 +18135,28 @@ "description": "An organization custom property definition was deleted.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "description", @@ -11914,11 +18164,6 @@ "required", "allowed_values", "default_value", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -11930,20 +18175,32 @@ "description": "An organization custom property definition was updated.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "old_values_editable_by", "values_editable_by", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -11958,21 +18215,31 @@ "description": "An organization's custom property value was manually set for the first time.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -11984,21 +18251,31 @@ "description": "An organization's custom property value was deleted.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -12010,18 +18287,30 @@ "description": "A default label was created for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", "fields": [ - "request_id", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", - "_document_id", - "action", - "created_at", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" }, @@ -12030,17 +18319,30 @@ "description": "A default label was deleted for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", "fields": [ - "operation_type", - "request_id", - "actor", "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" }, @@ -12049,17 +18351,30 @@ "description": "A default label was edited for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", "fields": [ - "org", - "created_at", "@timestamp", - "actor", + "_document_id", "action", - "user_agent", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" }, @@ -12068,20 +18383,33 @@ "description": "A domain was approved for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "org_id", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" }, @@ -12090,16 +18418,31 @@ "description": "A domain was added to an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "created_at", + "@timestamp", "_document_id", - "domain_name", "action", - "request_id", + "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "domain_name", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -12108,14 +18451,29 @@ "description": "A domain was removed from an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", "fields": [ - "action", - "domain_name", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "domain_name", "operation_type", "created_at" ], @@ -12126,16 +18484,31 @@ "description": "A domain was verified for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "operation_type", - "domain_name", "@timestamp", - "user_agent", - "request_id", - "actor", - "action", - "created_at", "_document_id", - "actor_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "domain_name", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -12144,16 +18517,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -12163,17 +18549,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -12183,16 +18580,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -12202,20 +18612,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -12223,19 +18643,30 @@ "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor", - "business_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", "user_agent", - "_document_id", "created_at", - "operation_type", - "request_id", - "business" + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -12244,19 +18675,30 @@ "description": "Organization projects were disabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "operation_type", - "@timestamp", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -12265,18 +18707,29 @@ "description": "Organization projects were enabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor_id", - "org_id", - "created_at", - "user_id", - "org", "@timestamp", "_document_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", + "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" @@ -12286,23 +18739,33 @@ "description": "An organization role was assigned to a user or team.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About custom organization roles" }, @@ -12311,25 +18774,32 @@ "description": "A custom organization role was created in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -12341,25 +18811,32 @@ "description": "A custom organization role was deleted in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -12370,19 +18847,30 @@ "description": "A user or team was unassigned an organization role.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type" ], @@ -12393,26 +18881,33 @@ "description": "A custom organization role was edited in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", "old_role_permissions", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -12425,22 +18920,33 @@ "description": "An organization's default project base role was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_project_base_role", - "new_project_base_role", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_project_base_role", + "new_project_base_role", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -12448,20 +18954,31 @@ "description": "An entire package was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" @@ -12471,23 +18988,34 @@ "description": "A package was published or republished to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "ecosystem", "version_count", "is_republished", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -12496,21 +19024,32 @@ "description": "A specific package version was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "version", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "ecosystem", "actor_is_bot" ], @@ -12521,21 +19060,34 @@ "description": "A specific package version was published or republished to a package.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "ecosystem", "package", "version", - "actor_id", - "user_agent", "is_republished", - "actor", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -12544,20 +19096,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -12566,17 +19132,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -12587,20 +19168,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -12609,18 +19204,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -12628,16 +19235,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -12645,18 +19266,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -12664,18 +19297,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -12686,22 +19332,31 @@ "description": "The configured restriction for access to resources via personal access tokens was disabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -12709,22 +19364,31 @@ "description": "The configured restriction for access to resources via personal access tokens was enabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -12732,18 +19396,28 @@ "description": "The configured restriction for access to resources via personal access tokens was reset and delegated to organizations.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -12754,18 +19428,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -12776,18 +19463,28 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -12798,18 +19495,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -12820,18 +19527,28 @@ "description": "Triggered when the enterprise delegates to the organizations when to require approval for fine-grained personal access tokens before the tokens can access organization resources.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -12842,23 +19559,34 @@ "description": "A personal access token expiration limit was set.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "token_expiration", "old_token_expiration", "exempt_administrators", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -12866,21 +19594,32 @@ "description": "A personal access token expiration limit was unset.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "programmatic_access_type", - "old_token_expiration", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_token_expiration", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -12888,17 +19627,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -12909,18 +19661,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repository_selection", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", + "repository_selection", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -12932,17 +19697,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -12954,20 +19732,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was created.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -12979,20 +19766,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -13004,20 +19800,29 @@ "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -13029,20 +19834,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -13054,15 +19868,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -13072,17 +19901,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -13092,15 +19932,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -13110,19 +19965,30 @@ "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "action", - "operation_type", "@timestamp", - "business_id", + "_document_id", + "action", + "actor", "actor_id", - "user", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13130,23 +19996,30 @@ "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "created_at", - "actor_id", + "@timestamp", "_document_id", - "actor", - "user", - "repo", "action", - "user_agent", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "request_id", - "user_id", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13154,23 +20027,30 @@ "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_id", - "operation_type", + "@timestamp", "_document_id", "action", - "@timestamp", - "repo", - "org", - "business", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org_id", - "created_at", - "business_id" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13178,17 +20058,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -13198,17 +20089,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -13218,17 +20120,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -13238,17 +20151,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -13258,17 +20182,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -13278,17 +20215,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13296,25 +20246,36 @@ "description": "A project's base role was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_project_base_role", "new_project_base_role", "project_number", "public_project", - "business", "project_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13322,20 +20283,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -13345,25 +20317,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "collaborator_type", - "org", - "org_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -13371,20 +20355,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -13392,25 +20388,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -13418,17 +20426,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -13436,17 +20457,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -13454,18 +20488,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -13474,18 +20520,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -13494,19 +20552,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -13514,17 +20583,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -13536,22 +20618,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -13559,19 +20650,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -13579,17 +20681,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13597,18 +20712,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -13616,20 +20744,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13637,18 +20775,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -13657,18 +20807,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -13677,16 +20839,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -13698,21 +20873,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -13720,22 +20907,32 @@ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", "fields": [ - "repo", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "name", "created_at", - "_document_id", "operation_type", - "actor", - "repo_id", - "org", - "request_id", - "actor_id", - "oauth_application_id", - "@timestamp", - "programmatic_access_type" + "oauth_application_id" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" }, @@ -13744,29 +20941,34 @@ "description": "A protected branch allowance was given to a specific user, team or integration.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "authorized_actors", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -13774,24 +20976,32 @@ "description": "Branch protection was enabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "repo_id", - "user_id", "@timestamp", - "user_agent", - "repo", - "name", - "org_id", - "user", "_document_id", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", "created_at", "authorized_actor_names", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -13802,21 +21012,31 @@ "description": "Branch protection was disabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "repo", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", - "request_id", - "repo_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "name", + "operation_type", "created_at", - "_document_id", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -13827,22 +21047,32 @@ "description": "Enforcement of dismissing stale pull requests was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "dismiss_stale_reviews_on_push", - "org_id", - "action", - "created_at", - "request_id", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismiss_stale_reviews_on_push", + "created_at", "operation_type", - "actor", - "repo", - "org", - "name", - "programmatic_access_type" + "name" ] }, { @@ -13850,24 +21080,34 @@ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "authorized_actors_only", "authorized_actors", "created_at", - "user_agent", "name", - "_document_id", - "org_id", - "request_id", - "@timestamp", - "actor_id", - "org", - "action", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -13875,30 +21115,37 @@ "description": "A branch protection requirement was overridden by a repository administrator.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "actor", "reasons", - "@timestamp", "before", "after", - "actor_id", - "repo", "operation_type", - "user_agent", "branch", "overridden_codes", - "org", - "org_id", - "action", - "_document_id", - "request_id", "referrer", - "business", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "rule_suite_id" ] @@ -13908,28 +21155,36 @@ "description": "A branch update attempt was rejected.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "request_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "branch", "before", "overridden_codes", "after", - "action", "reasons", - "actor_id", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "actor_is_bot", "rule_suite_id" @@ -13940,23 +21195,32 @@ "description": "Branch protection was enforced for repository administrators.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "admin_enforced", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "name", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "action", "repo_id", - "org_id", - "_document_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "admin_enforced", + "operation_type", + "name", + "created_at" ] }, { @@ -13964,23 +21228,32 @@ "description": "Force pushes were enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "actor_id", - "name", + "@timestamp", "_document_id", + "action", "actor", - "repo", - "operation_type", - "request_id", - "allow_force_pushes_enforcement_level", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_force_pushes_enforcement_level", + "created_at" ] }, { @@ -13988,24 +21261,33 @@ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "ignore_approvals_from_contributors", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -14014,24 +21296,33 @@ "description": "Fork syncing was enabled or disabled for a read-only branch", "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "lock_allows_fetch_and_merge", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -14040,27 +21331,34 @@ "description": "The enforcement of a branch lock was updated.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "enforcement_level", "lock_branch_enforcement_level", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -14069,18 +21367,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -14091,24 +21402,33 @@ "description": "A branch name pattern was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "old_name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "old_name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -14116,25 +21436,32 @@ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", "docs_reference_links": "N/A", "fields": [ - "name", - "org_id", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "@timestamp", + "business", "business_id", - "request_id", - "pull_request_reviews_enforcement_level", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "business", - "user_agent", - "created_at", "repo_id", - "operation_type", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "pull_request_reviews_enforcement_level", + "created_at", + "operation_type" ] }, { @@ -14142,22 +21469,32 @@ "description": "Enforcement of required code owner review was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "created_at", - "require_code_owner_review", - "operation_type", - "name", - "user_agent", - "action", "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "request_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "require_code_owner_review", + "operation_type", + "name" ] }, { @@ -14165,46 +21502,67 @@ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "require_last_push_approval", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", + "operation_type" + ], + "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" + }, + { + "action": "protected_branch.update_required_approving_review_count", + "description": "Enforcement of the required number of approvals before merging was updated on a branch.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" - }, - { - "action": "protected_branch.update_required_approving_review_count", - "description": "Enforcement of the required number of approvals before merging was updated on a branch.", - "docs_reference_links": "N/A", - "fields": [ - "required_approving_review_count", "repo", - "request_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "required_approving_review_count", "created_at", - "actor", "operation_type", - "user_agent", - "name", - "org_id", - "action", - "actor_id", - "_document_id", - "org", - "@timestamp", - "programmatic_access_type" + "name" ] }, { @@ -14212,25 +21570,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "user_agent", "@timestamp", "_document_id", - "name", - "repo", "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "business", - "actor_id", - "operation_type", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "required_status_checks_enforcement_level", - "org", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "required_status_checks_enforcement_level" ] }, { @@ -14238,22 +21603,32 @@ "description": "Enforcement of required commit signing was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "name", "@timestamp", - "created_at", "_document_id", - "request_id", - "repo_id", - "org", - "org_id", "action", "actor", "actor_id", - "signature_requirement_enforcement_level", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "programmatic_access_type" + "operation_type", + "name", + "created_at", + "signature_requirement_enforcement_level" ] }, { @@ -14261,22 +21636,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "created_at", - "repo_id", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "name", - "actor", - "repo", "operation_type", - "action", - "strict_required_status_checks_policy", - "programmatic_access_type" + "strict_required_status_checks_policy" ] }, { @@ -14284,23 +21669,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -14309,24 +21705,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -14335,20 +21742,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -14357,21 +21778,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -14381,22 +21815,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -14405,25 +21851,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -14432,23 +21888,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", "key", "fingerprint", - "actor_id", - "actor", "title", - "user_agent", - "user_id", - "request_id", - "read_only", - "token_scopes", - "programmatic_access_type" + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -14457,18 +21924,32 @@ "description": "A pull request was closed without being merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" @@ -14478,21 +21959,32 @@ "description": "A pull request was converted to a draft.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" }, @@ -14501,19 +21993,32 @@ "description": "A pull request was created.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -14524,23 +22029,35 @@ "description": "A review was requested on a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -14550,17 +22067,31 @@ "description": "A pull request was marked as in progress.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14568,19 +22099,32 @@ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -14588,19 +22132,32 @@ "description": "A pull request was merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" @@ -14610,21 +22167,32 @@ "description": "A pull request was marked as ready for review.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" }, @@ -14633,27 +22201,34 @@ "description": "A pull request was rebased.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "pull_request_url", "pull_request_title", - "user", - "user_id", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -14661,23 +22236,35 @@ "description": "A review request was removed from a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" }, @@ -14686,18 +22273,32 @@ "description": "A pull request was reopened after previously being closed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -14705,19 +22306,31 @@ "description": "A review comment was added to a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "comment_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -14727,20 +22340,31 @@ "description": "A review comment on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", "@timestamp", "_document_id", - "repo", - "created_at", - "request_id", - "comment_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "comment_id", + "operation_type" ] }, { @@ -14748,18 +22372,31 @@ "description": "A review comment on a pull request was changed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "request_id", - "actor_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "_document_id", - "@timestamp", - "comment_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "comment_id" ] }, { @@ -14767,21 +22404,33 @@ "description": "A review on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ] }, { @@ -14789,20 +22438,33 @@ "description": "A review on a pull request was dismissed.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" }, @@ -14811,19 +22473,33 @@ "description": "A review on a pull request was submitted.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" @@ -14833,22 +22509,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -14857,21 +22543,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -14880,25 +22575,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -14907,23 +22609,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -14932,24 +22642,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -14958,23 +22675,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -14984,22 +22709,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -15008,19 +22742,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -15029,24 +22776,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -15055,24 +22812,32 @@ "description": "Autofix for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15080,24 +22845,32 @@ "description": "Autofix for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15105,24 +22878,32 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15130,24 +22911,32 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15155,23 +22944,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -15182,17 +22980,29 @@ "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15202,17 +23012,29 @@ "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15222,25 +23044,31 @@ "description": "Code scanning using the default setup was disabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -15249,26 +23077,34 @@ "description": "Code scanning using the default setup was enabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "query_suite", "threat_model", - "languages", - "request_access_security_header" + "languages" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -15277,25 +23113,34 @@ "description": "Code scanning using the default setup was updated for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "query_suite", "threat_model", "languages", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Configuring default setup for code scanning" @@ -15305,19 +23150,30 @@ "description": "GitHub Codespaces was granted trusted repository access to this repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -15326,19 +23182,30 @@ "description": "GitHub Codespaces trusted repository access to this repository was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15346,17 +23213,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -15365,15 +23245,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -15384,16 +23277,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -15403,17 +23309,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -15423,19 +23342,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -15444,17 +23374,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -15463,26 +23406,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -15491,30 +23440,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -15524,20 +23478,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -15546,25 +23511,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -15573,23 +23546,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -15597,25 +23581,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -15625,23 +23618,32 @@ "description": "A source code archive of a repository was downloaded as a ZIP file.", "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "created_at", "operation_type", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" @@ -15651,24 +23653,32 @@ "description": "The setting for immutable releases was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15677,20 +23687,30 @@ "description": "The setting for immutable releases was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -15701,23 +23721,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -15725,21 +23755,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -15747,21 +23787,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -15769,22 +23819,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -15792,21 +23851,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -15814,20 +23883,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15835,22 +23915,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -15858,18 +23947,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -15877,22 +23980,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -15900,21 +24013,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -15922,18 +24045,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -15942,22 +24077,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -15966,24 +24110,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -15992,23 +24144,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -16016,26 +24178,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -16044,21 +24211,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -16067,25 +24243,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "repo_id", - "user_agent", - "topic", - "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", "@timestamp", - "created_at", "_document_id", + "action", + "actor", "actor_id", + "business", "business_id", - "programmatic_access_type" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "topic", + "operation_type", + "created_at" ] }, { @@ -16093,22 +24275,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -16117,25 +24309,34 @@ "description": "A branch was renamed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "old_branch", - "new_branch", - "default_branch", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "old_branch", + "new_branch", + "default_branch", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch" @@ -16145,19 +24346,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -16165,17 +24377,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -16184,17 +24411,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -16203,7 +24445,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -16218,22 +24481,30 @@ "description": "The cache retention policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -16245,22 +24516,30 @@ "description": "The cache storage policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -16272,23 +24551,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -16298,20 +24586,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -16322,21 +24621,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -16345,22 +24655,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -16369,21 +24689,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -16392,22 +24723,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -16418,16 +24759,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -16436,22 +24788,31 @@ "description": "Temporary access was enabled for a repository.", "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing user-owned repositories in your enterprise" }, @@ -16461,22 +24822,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -16485,23 +24857,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -16511,19 +24893,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", "user_agent", + "operation_type", "created_at", - "actor", - "visibility", - "repo_id", - "actor_id", - "repo", - "request_access_security_header" + "visibility" ] }, { @@ -16531,21 +24923,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -16554,24 +24956,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -16579,25 +24990,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -16606,24 +25024,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -16632,25 +25060,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -16659,22 +25095,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -16683,26 +25128,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -16710,31 +25163,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -16743,22 +25203,30 @@ "description": "Someone closed a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "repo", - "@timestamp", + "actor_id", "business", "business_id", - "user_agent", - "actor_id", - "request_id", - "action", - "operation_type", - "created_at", - "repo_id", - "_document_id", + "hashed_token", "org", "org_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "About repository security advisories" }, @@ -16767,18 +25235,29 @@ "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "repo", - "org_id", - "actor", + "@timestamp", + "_document_id", "action", - "request_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "_document_id", + "operation_type", "created_at" ] }, @@ -16787,17 +25266,30 @@ "description": "GitHub made a security advisory public in the GitHub Advisory Database.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -16806,21 +25298,30 @@ "description": "GitHub withdrew a security advisory that was published in error.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -16828,18 +25329,30 @@ "description": "Someone opened a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", "repo_id", - "action", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16847,21 +25360,30 @@ "description": "Someone published a security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", "@timestamp", - "actor", - "repo_id", "_document_id", - "repo", - "business_id", - "business", - "request_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "org" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16869,17 +25391,30 @@ "description": "Someone reopened as draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "repo", - "action", - "created_at", "@timestamp", - "request_id", - "actor_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "public_repo" ] }, @@ -16888,21 +25423,30 @@ "description": "Someone edited a draft or published security advisory.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "repo_id", - "org_id", "business", - "actor", - "user_agent", - "created_at", - "_document_id", "business_id", - "repo", - "action", - "operation_type", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16910,24 +25454,30 @@ "description": "Branch protections were disabled for the repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -16936,24 +25486,30 @@ "description": "Branch protections were enabled for this repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -16962,25 +25518,31 @@ "description": "Code security was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -16989,25 +25551,31 @@ "description": "Code security was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -17016,19 +25584,30 @@ "description": "Data use settings were disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "repo_id", - "request_id", - "actor_id", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -17037,21 +25616,30 @@ "description": "Data use settings were enabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "org", - "user_id", - "repo_id", "@timestamp", - "request_id", - "actor", + "_document_id", "action", - "operation_type", - "created_at", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org_id", - "_document_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -17060,23 +25648,30 @@ "description": "The dependency graph was disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "repo_id", - "operation_type", - "user_id", - "repo", + "@timestamp", "_document_id", - "actor", - "user", "action", - "@timestamp", - "org_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", - "request_id", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -17085,24 +25680,31 @@ "description": "The dependency graph was enabled for a private repository.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor_id", - "repo_id", + "created_at", "operation_type", - "actor", - "@timestamp", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -17111,19 +25713,29 @@ "description": "Dependency updates on self-hosted runners was disabled.", "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -17134,23 +25746,32 @@ "description": "Dependency updates on self-hosted runners was enabled.", "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners", "fields": [ - "topic", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "topic", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "actor_is_agent" ], @@ -17161,21 +25782,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "content_type", - "repo", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -17183,21 +25814,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -17205,21 +25846,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -17227,20 +25879,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -17248,21 +25912,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -17270,19 +25945,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -17290,19 +25978,30 @@ "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", "fields": [ - "request_id", - "created_at", + "@timestamp", "_document_id", "action", - "user_agent", - "user", - "business_id", - "business", - "operation_type", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -17311,20 +26010,30 @@ "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "created_at", "@timestamp", - "repo", - "action", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "repo_id", - "actor", - "request_id", - "programmatic_access_type" + "created_at", + "operation_type" ] }, { @@ -17333,20 +26042,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", "created_at", - "org_id", - "action", - "user_id", - "operation_type", - "_document_id", - "actor_id", - "repo" + "operation_type" ] }, { @@ -17354,31 +26072,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -17387,19 +26113,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -17407,8 +26144,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -17417,23 +26153,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -17458,26 +26203,32 @@ "description": "Automatic partner validation checks have been disabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -17486,26 +26237,32 @@ "description": "Automatic partner validation checks have been enabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -17514,23 +26271,30 @@ "description": "A custom pattern was created for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -17540,23 +26304,30 @@ "description": "A custom pattern was removed from secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -17566,24 +26337,31 @@ "description": "A custom pattern was published for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -17593,24 +26371,31 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -17619,24 +26404,31 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -17646,23 +26438,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -17672,23 +26471,31 @@ "description": "Secret scanning was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "public_repo", - "programmatic_access_type" + "public_repo" ], "docs_reference_titles": "About secret scanning" }, @@ -17697,22 +26504,30 @@ "description": "Secret scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17720,25 +26535,31 @@ "description": "Metadata for secret scanning alerts has been disabled at the repository level", "docs_reference_links": "/code-security/secret-scanning/enabling-secret-scanning-features/enabling-extended-metadata-checks-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enabling extended metadata checks for your repository" @@ -17748,24 +26569,32 @@ "description": "Generic secrets have been disabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -17773,22 +26602,31 @@ "description": "Generic secrets have been enabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -17797,24 +26635,32 @@ "description": "Secret scanning for non-provider patterns was disabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -17823,24 +26669,32 @@ "description": "Secret scanning for non-provider patterns was enabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -17849,19 +26703,31 @@ "description": "A role or team was added to the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "repo_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -17870,24 +26736,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -17896,24 +26770,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -17922,19 +26804,31 @@ "description": "A role or team was removed from the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -17943,26 +26837,31 @@ "description": "Secret scanning push protection was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -17971,26 +26870,31 @@ "description": "Secret scanning push protection was enabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -17999,28 +26903,36 @@ "description": "A code security configuration was applied to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -18028,27 +26940,35 @@ "description": "A code security configuration failed to attach to the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -18056,28 +26976,36 @@ "description": "A code security configuration was removed from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -18085,28 +27013,36 @@ "description": "A code security configuration was removed due to a change in repository or enterprise settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -18114,19 +27050,29 @@ "description": "Dependabot security updates was disabled.", "docs_reference_links": "/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -18137,27 +27083,31 @@ "description": "Dependabot security updates was enabled.", "docs_reference_links": "/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates", "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "actor_is_agent" ], @@ -18168,20 +27118,30 @@ "description": "The repository visibility change setting was cleared for an organization or enterprise.", "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", "fields": [ - "created_at", + "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", "business", - "action", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business_id", - "@timestamp", "user_agent", - "actor", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise" }, @@ -18190,20 +27150,30 @@ "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user", - "org_id", - "created_at", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "_document_id", - "@timestamp", - "user_id", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -18211,19 +27181,30 @@ "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "_document_id", "@timestamp", - "user_agent", - "user", - "created_at", - "org", - "org_id", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -18231,29 +27212,37 @@ "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -18262,29 +27251,37 @@ "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -18293,19 +27290,32 @@ "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ - "operation_type", - "request_id", - "repo_id", "@timestamp", - "user_agent", - "alert_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "alert_id", + "created_at", + "alert_number" ], "docs_reference_titles": "About Dependabot alerts" }, @@ -18314,23 +27324,32 @@ "description": "A Dependabot alert was manually dismissed.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "operation_type", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "alert_id", - "actor", - "repo", "created_at", - "org", - "_document_id", - "action", - "actor_id", "dismiss_reason", - "user", "dismiss_comment", "alert_number", "actor_is_bot" @@ -18341,21 +27360,33 @@ "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "public_repo", "owner", - "_document_id", - "@timestamp", "operation_type", - "token_scopes", "alert_number" ] }, @@ -18364,26 +27395,34 @@ "description": "A Dependabot alert was manually reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type", - "business", - "business_id", "public_repo", - "alert_number", - "request_access_security_header" + "alert_number" ] }, { @@ -18391,21 +27430,32 @@ "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", "docs_reference_links": "N/A", "fields": [ - "alert_id", - "repo", - "operation_type", - "action", - "repo_id", - "_document_id", - "user_agent", - "request_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "alert_id", + "operation_type", + "created_at", + "alert_number" ] }, { @@ -18413,21 +27463,35 @@ "description": "A Dependabot alert was withdrawn.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", "created_at", "active", - "action", - "repository_id", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type" ] }, @@ -18436,20 +27500,30 @@ "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", "fields": [ - "org", + "@timestamp", "_document_id", - "repo", - "org_id", - "operation_type", - "created_at", - "actor", "action", - "@timestamp", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" }, @@ -18458,24 +27532,31 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -18483,26 +27564,32 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -18510,23 +27597,30 @@ "description": "Dependabot alerts was disabled.", "docs_reference_links": "N/A", "fields": [ - "repo", - "request_id", - "repo_id", - "action", - "actor_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "_document_id", "user_id", - "operation_type", - "token_scopes", - "programmatic_access_type" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -18534,23 +27628,30 @@ "description": "Dependabot alerts was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_agent", - "created_at", "@timestamp", - "repo_id", + "_document_id", "action", - "user", - "repo", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor_id", - "_document_id", - "user_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot" ] }, @@ -18559,24 +27660,31 @@ "description": "A status check was marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "org", - "actor_id", "@timestamp", - "business", - "request_id", - "context", - "repo_id", - "action", - "repo", "_document_id", - "operation_type", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "actor", - "created_at", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "context", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -18585,21 +27693,31 @@ "description": "A status check was no longer marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "actor_id", - "actor", - "created_at", - "context", - "operation_type", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "repo_id", "org_id", - "action", - "_document_id", + "programmatic_access_type", "repo", - "programmatic_access_type" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "context", + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -18608,18 +27726,31 @@ "description": "Email notification restrictions for an organization or enterprise were disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -18628,19 +27759,31 @@ "description": "Email notification restrictions for an organization or enterprise were enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -18649,22 +27792,33 @@ "description": "A new custom repository role was created.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "owner", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", - "_document_id", "role_permissions", "old_role_permissions" ], @@ -18675,23 +27829,34 @@ "description": "A custom repository role was deleted.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Managing custom repository roles for an organization" }, @@ -18700,23 +27865,34 @@ "description": "A custom repository role was edited.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "old_role_permissions", "old_base_role" ], @@ -18727,14 +27903,28 @@ "description": "A user was assigned to a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -18749,14 +27939,28 @@ "description": "GitHub detected a secret and created a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -18770,14 +27974,28 @@ "description": "A secret scanning alert was deleted by GitHub.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -18793,14 +28011,28 @@ "description": "A secret scanning alert was leaked in a public repo.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -18815,22 +28047,32 @@ "description": "A secret scanning alert was reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type_display_name" ] }, @@ -18839,14 +28081,28 @@ "description": "A leaked secret was reported to the secret's provider by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "created_at", @@ -18861,28 +28117,37 @@ "description": "A secret scanning alert was resolved.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "resolution", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", + "resolution", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type", "secret_type_display_name", "publicly_leaked", - "multi_repo", - "request_access_security_header" + "multi_repo" ] }, { @@ -18890,25 +28155,32 @@ "description": "A secret scanning alert was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -18916,14 +28188,28 @@ "description": "A user was unassigned from a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -18938,14 +28224,28 @@ "description": "A secret scanning alert was validated.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "previous_validity", @@ -18962,26 +28262,34 @@ "description": "A request to close a secret scanning alert was approved by a user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "request_reviewer_comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -18990,25 +28298,33 @@ "description": "N/A", "docs_reference_links": "A reqeust to close a secret scanning alert was canceled by a user.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "A, reqeust, to, close, a, secret, scanning, alert, was, canceled, by, a, user." @@ -19018,27 +28334,35 @@ "description": "N/A", "docs_reference_links": "A user requested to close a secret scanning alert.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "reason", "comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "A, user, requested, to, close, a, secret, scanning, alert." @@ -19048,26 +28372,34 @@ "description": "A request to close a secret scanning alert was denied by a user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "request_reviewer_comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -19076,19 +28408,30 @@ "description": "Secret scanning was disabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -19097,19 +28440,30 @@ "description": "Secret scanning was enabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -19118,20 +28472,30 @@ "description": "Secret scanning was disabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -19140,19 +28504,30 @@ "description": "Secret scanning was enabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -19161,14 +28536,28 @@ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "push_protection_bypass_reason", @@ -19186,25 +28575,33 @@ "description": "A request to bypass secret scanning push protection was approved by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -19213,24 +28610,32 @@ "description": "A user canceled a request to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" @@ -19240,24 +28645,32 @@ "description": "A user pushed a commit containing a secret for which there is an approved secret scanning push protection bypass request.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" @@ -19267,25 +28680,33 @@ "description": "A request to bypass secret scanning push protection was denied by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", - "request_access_security_header", "request_reviewer_comment" ], "docs_reference_titles": "About push protection" @@ -19295,25 +28716,33 @@ "description": "A user requested to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" }, @@ -19322,22 +28751,35 @@ "description": "A secret scanning scan has completed on this repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "repo_id", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "source", "type", "source_slug", "type_slug", "started_at", "completed_at", - "repo", "public_repo", - "org", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "secret_types", @@ -19351,10 +28793,28 @@ "description": "A security configuration was created", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -19369,15 +28829,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -19395,22 +28848,33 @@ "description": "A default security configuration setting for new repositories was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -19419,22 +28883,33 @@ "description": "A default security configuration setting for new repositories was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -19443,10 +28918,28 @@ "description": "A security configuration was deleted", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -19461,15 +28954,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -19486,15 +28972,30 @@ "description": "A security configuration policy was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enforcement", "security_configuration_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -19504,10 +29005,28 @@ "description": "A security configuration was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -19522,15 +29041,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -19548,16 +29060,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -19567,18 +29092,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -19587,16 +29125,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -19607,15 +29158,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -19625,15 +29189,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -19642,17 +29221,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -19661,17 +29253,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -19680,16 +29286,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -19699,14 +29318,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -19716,17 +29350,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -19735,17 +29382,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -19754,18 +29414,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -19774,15 +29447,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -19792,16 +29479,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -19809,15 +29509,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -19828,16 +29541,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -19847,17 +29573,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -19868,17 +29607,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "patreon_email", "patreon_username", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -19889,18 +29641,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -19910,16 +29673,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -19929,16 +29705,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -19950,17 +29739,30 @@ "fields": [ "@timestamp", "_document_id", - "fingerprint", - "operation_type", - "openssh_public_key", - "org_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "request_id" + "fingerprint", + "operation_type", + "openssh_public_key", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -19969,19 +29771,32 @@ "description": "An SSH certificate authority for an organization or enterprise was deleted.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "created_at", + "@timestamp", "_document_id", - "fingerprint", - "operation_type", + "action", "actor", - "org_id", - "openssh_public_key", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", - "request_id" + "created_at", + "fingerprint", + "operation_type", + "openssh_public_key" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -19990,21 +29805,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "user", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "request_id", - "org", - "org_id", - "created_at", - "actor", "action", - "user_id", + "actor", + "actor_id", "business", "business_id", - "@timestamp", - "actor_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -20013,19 +29837,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "actor_id", - "user_id", - "org", - "operation_type", - "request_id", "@timestamp", "_document_id", - "actor", - "user", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -20034,16 +29869,28 @@ "description": "SSO lockdown for users was disabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -20054,16 +29901,28 @@ "description": "SSO lockdown for users was enabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -20074,15 +29933,28 @@ "description": "Automatic redirects for users to single sign-on (SSO) was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -20092,15 +29964,28 @@ "description": "Automatic redirects for users to single sign-on (SSO) was enabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -20110,20 +29995,34 @@ "description": "The verification code expiry time for an organization or enterprise domain was set.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "token_expires_at", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -20131,18 +30030,33 @@ "description": "An organization or enterprise domain was unverified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ] }, { @@ -20150,16 +30064,31 @@ "description": "An organization or enterprise domain was verified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "domain_name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -20167,21 +30096,31 @@ "description": "A member of an organization was added to a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", "fields": [ - "user_agent", - "request_id", - "org_id", - "user_id", - "team", - "user", "@timestamp", - "actor_id", - "created_at", - "operation_type", "_document_id", - "org", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" @@ -20191,22 +30130,31 @@ "description": "A team was given access and permissions to a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "team", - "action", - "operation_type", - "request_id", - "created_at", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "actor_id", - "_document_id", "repo_id", - "user_agent", - "org_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -20215,20 +30163,30 @@ "description": "A team was added to an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team_type", "team", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -20239,20 +30197,31 @@ "description": "A child team was created or a child team's parent was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", "fields": [ - "org", "@timestamp", - "created_at", "_document_id", - "team", "action", - "operation_type", "actor", - "request_id", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", + "operation_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" }, @@ -20261,18 +30230,31 @@ "description": "A team's privacy level was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", "fields": [ - "user_agent", - "request_id", - "org", + "@timestamp", + "_document_id", "action", - "team", - "created_at", - "operation_type", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "actor", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" @@ -20282,21 +30264,32 @@ "description": "A new team is created.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "oauth_application_id", + "operation_type", "team", - "org", - "actor", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "team_type" ] }, @@ -20305,21 +30298,31 @@ "description": "A user was demoted from a team maintainer to a team member.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" }, @@ -20328,19 +30331,31 @@ "description": "A team was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "team", "org_id", - "actor_id", - "actor", - "action", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", "operation_type", - "_document_id", - "programmatic_access_type", "team_type" ] }, @@ -20349,22 +30364,31 @@ "description": "A user was promoted from a team member to a team maintainer.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" }, @@ -20373,20 +30397,30 @@ "description": "A team was removed from an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team_type", "team", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -20397,22 +30431,31 @@ "description": "An organization member was removed from a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", "fields": [ - "request_id", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "team", - "user_id", - "actor", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", + "user_id", "user_agent", - "_document_id", - "token_scopes", - "programmatic_access_type", + "operation_type", + "created_at", + "team", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" @@ -20422,21 +30465,31 @@ "description": "A repository was removed from a team's control.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "org_id", - "repo", - "repo_id", - "action", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "created_at", "team", - "org", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -20444,21 +30497,32 @@ "description": "A team's name was changed.", "docs_reference_links": "N/A", "fields": [ - "name", - "user_agent", - "created_at", - "team", - "operation_type", - "actor_id", - "org", + "@timestamp", + "_document_id", "action", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "_document_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "team", + "operation_type", "team_type" ] }, @@ -20467,17 +30531,30 @@ "description": "Team synchronization with a tenant was disabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "request_id", - "org_id", "actor_id", - "operation_type", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -20486,19 +30563,30 @@ "description": "Team synchronization with a tenant was enabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ - "org_id", - "business_id", - "actor", - "created_at", - "user_agent", "@timestamp", - "operation_type", - "business", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -20507,19 +30595,30 @@ "description": "The Okta credentials for team synchronization with a tenant were changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -20527,28 +30626,37 @@ "description": "A team's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "team", - "org_id", "@timestamp", - "org", "_document_id", - "old_permission", - "request_id", - "repo", "action", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "old_permission", "operation_type", "created_at", - "user_agent", "permission", "new_repo_permission", "new_repo_base_role", "old_repo_permission", - "old_repo_base_role", - "token_scopes", - "programmatic_access_type" + "old_repo_base_role" ] }, { @@ -20556,23 +30664,38 @@ "description": "Triggered when a user content edit is deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_content_id", "user_content_type", "created_at", - "user_agent", "deleted_by", "editor_id", - "_document_id", "deleted_at", - "action", - "actor_id", "editor", "deleted_by_id", "deleted_content", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -20580,21 +30703,31 @@ "description": "An enterprise managed user claimed an email address.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -20602,21 +30735,31 @@ "description": "N/A", "docs_reference_links": "An enterprise managed user unclaimed an email address.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." }, @@ -20625,16 +30768,30 @@ "description": "A Dependabot rule was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -20644,16 +30801,30 @@ "description": "A Dependabot rule was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -20663,18 +30834,31 @@ "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -20684,21 +30868,33 @@ "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -20706,21 +30902,32 @@ "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -20728,21 +30935,32 @@ "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -20750,16 +30968,30 @@ "description": "A Dependabot rule's conditions, actions, or metadata changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -20769,27 +31001,33 @@ "description": "A workflow job was approved.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", - "repo", - "repo_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -20798,23 +31036,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -20822,10 +31070,28 @@ "description": "A workflow run was cancelled.", "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -20836,20 +31102,9 @@ "run_number", "cancelled_at", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Canceling a workflow run" }, @@ -20858,23 +31113,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -20884,10 +31147,28 @@ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -20899,19 +31180,9 @@ "conclusion", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -20922,10 +31193,28 @@ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -20934,21 +31223,10 @@ "head_branch", "head_sha", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "public_repo", - "programmatic_access_type", "actor_is_bot", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "Understanding GitHub Actions" @@ -20958,23 +31236,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -20983,22 +31273,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -21006,21 +31307,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -21028,25 +31340,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -21054,23 +31374,36 @@ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", "fields": [ - "repo_id", - "repo", - "org_id", - "org", - "business_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "job_name", "runner_labels", "is_hosted_runner", "environment_name", "secrets_passed", - "action", - "_document_id", "operation_type", "created_at", - "@timestamp", "runner_owner_type", "job_workflow_ref", "calling_workflow_refs", @@ -21084,24 +31417,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -21110,10 +31452,28 @@ "description": "A workflow run was re-run.", "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -21123,21 +31483,11 @@ "head_sha", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", "rerun_type", "check_run_id", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "Re-running workflows and jobs" @@ -21147,25 +31497,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghec/organization.json b/src/audit-logs/data/ghec/organization.json index 87b056266bce..f08e99a42520 100644 --- a/src/audit-logs/data/ghec/organization.json +++ b/src/audit-logs/data/ghec/organization.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,29 +67,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -72,21 +103,32 @@ "description": "Credit was accepted for a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Editing a repository security advisory" }, @@ -95,21 +137,32 @@ "description": "Someone was added to the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -117,21 +170,32 @@ "description": "Credit was declined for a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -140,21 +204,32 @@ "description": "Someone was removed from the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -163,18 +238,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -182,17 +269,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -203,43 +301,66 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" - }, + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + }, { "action": "billing.budget_create", "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -255,22 +376,34 @@ "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "uuid", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -278,25 +411,37 @@ "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", - "request_access_security_header", "old_target_amount", "old_budget_limit_type", "old_alert_enabled", @@ -310,17 +455,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -329,19 +487,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -350,15 +520,28 @@ "description": "Azure subscription has been linked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -368,15 +551,28 @@ "description": "Azure subscription has been unlinked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -386,18 +582,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -405,16 +614,28 @@ "description": "The premium request paid usage policy for your GitHub account was changed.", "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -426,39 +647,62 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "operation_type", - "user_agent", - "created_at", - "user_id", - "request_id", - "actor", - "action", "@timestamp", "_document_id", - "programmatic_access_type" - ] - }, - { - "action": "checks.auto_trigger_disabled", - "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", - "fields": [ - "visibility", - "user_agent", - "user", - "@timestamp", - "repo", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "checks.auto_trigger_disabled", + "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -467,20 +711,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -491,17 +746,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -509,15 +776,31 @@ "description": "Existing code scanning alerts appeared in a branch.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -527,15 +810,31 @@ "description": "Code scanning alerts were fixed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -545,15 +844,31 @@ "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_numbers", "commit_oid", - "ref", - "request_id", - "org_id", - "org", - "business_id", - "business" + "ref" ], "docs_reference_titles": "About code scanning" }, @@ -562,15 +877,29 @@ "description": "Code scanning alerts were manually dismissed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers", "dismissal_approver_id" ], @@ -581,19 +910,31 @@ "description": "Dismissal of code scanning alerts was approved.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -604,19 +945,31 @@ "description": "Dismissal of code scanning alerts was denied.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "dismissal_request_id", - "alert_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", - "action", - "_document_id", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismissal_request_id", + "alert_number", + "public_repo", "created_at", "operation_type" ], @@ -627,19 +980,31 @@ "description": "Dismissal of code scanning alerts was requested.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -650,13 +1015,31 @@ "description": "Code scanning alerts were seen for the first time.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -666,15 +1049,31 @@ "description": "Code scanning alerts that were previously fixed reappeared.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -684,15 +1083,29 @@ "description": "Code scanning alerts that were previously dismissed were reopened.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -702,14 +1115,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -719,28 +1147,34 @@ "description": "An attempt to create a codespace from a prebuild was made.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "owner", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "user_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_id", + "user_agent", + "name", + "owner", + "pull_request_id", "created_at", "operation_type", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -748,17 +1182,30 @@ "description": "Enterprise setting for Codespaces ownership was updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enablement", "organization_names", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -769,25 +1216,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -798,22 +1254,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -825,22 +1292,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -849,15 +1327,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -868,15 +1361,28 @@ "description": "Policies were applied to codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -886,20 +1392,30 @@ "description": "Policies were removed from codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -907,19 +1423,30 @@ "description": "Policies were updated for codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -927,17 +1454,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -947,27 +1487,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "org", "owner", "pull_request_id", "machine_type", - "user_id", - "user", "devcontainer_path", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -975,19 +1524,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -995,18 +1557,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -1015,20 +1589,30 @@ "description": "A commit comment was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "repo", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "created_at", - "@timestamp", - "operation_type", + "programmatic_access_type", + "repo", "repo_id", - "actor_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", - "user_agent", - "action", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1036,21 +1620,30 @@ "description": "A commit comment was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "repo_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_id", - "action", - "@timestamp", - "repo", "org_id", - "actor_id", - "created_at", - "user_agent", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1058,21 +1651,33 @@ "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "reason", "plan", - "org_id", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1080,13 +1685,28 @@ "description": "Copilot feature settings were changed at the organization level.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1096,23 +1716,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -1120,16 +1747,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -1138,24 +1779,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -1163,15 +1810,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1181,20 +1841,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -1202,19 +1872,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -1222,21 +1904,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "business", - "business_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1244,21 +1935,33 @@ "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_value", "new_value", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1266,21 +1969,32 @@ "description": "The excluded paths for GitHub Copilot were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "excluded_paths", "owner_type", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1288,14 +2002,28 @@ "description": "Copilot custom instructions were created for the organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "action", - "_document_id", - "@timestamp", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "custom_instructions" @@ -1306,14 +2034,28 @@ "description": "Copilot custom instructions were updated for the organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "action", - "_document_id", - "@timestamp", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "custom_instructions" @@ -1324,17 +2066,30 @@ "description": "The plan for GitHub Copilot was updated.", "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_plan", "plan", - "business_id", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1346,20 +2101,31 @@ "description": "The plan for GitHub Copilot was scheduled to be downgraded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "current_plan", "scheduled_plan" @@ -1370,18 +2136,30 @@ "description": "MCP Configuration for Copilot coding agent was updated for a specific repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "new_config", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "new_config", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1391,22 +2169,33 @@ "description": "Specific repositories were disabled from using Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "owner_type", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1414,21 +2203,31 @@ "description": "Specific repositories were enabled to use Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "owner_type", - "owner", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1438,20 +2237,32 @@ "description": "Copilot coding agent access was updated for the organization's or user's repositories.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_access", "old_access", - "org_id", "owner_type", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1461,21 +2272,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1485,19 +2305,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1507,21 +2336,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1531,18 +2369,31 @@ "description": "A new custom property definition was created.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -1555,18 +2406,31 @@ "description": "A custom property definition was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -1580,14 +2444,29 @@ "description": "A custom property definition was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "value_type", @@ -1600,8 +2479,7 @@ "old_default_value", "old_value_type", "old_values_editable_by", - "values_editable_by", - "request_access_security_header" + "values_editable_by" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1610,27 +2488,35 @@ "description": "A repository's custom property value was manually set for the first time.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1639,19 +2525,31 @@ "description": "A repository's custom property value was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1660,16 +2558,29 @@ "description": "A repository's custom property value was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repository", - "repository_id", - "public_repo", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "public_repo", "created_at", "operation_type", "definition_id" @@ -1681,19 +2592,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1702,19 +2624,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1723,19 +2656,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1744,19 +2688,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1765,25 +2720,33 @@ "description": "Dismissal of Dependabot alerts was approved.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -1793,25 +2756,33 @@ "description": "Dismissal request for Dependabot alerts was canceled.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -1821,25 +2792,33 @@ "description": "Dismissal of Dependabot alerts was requested.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -1849,25 +2828,33 @@ "description": "Dismissal of Dependabot alerts was denied.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -1877,21 +2864,31 @@ "description": "The default repository access for Dependabot was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", "org", "org_id", - "access_level", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "access_level", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -1900,17 +2897,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1918,19 +2928,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1939,19 +2960,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1959,19 +2991,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1980,19 +3023,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2000,19 +3054,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -2021,19 +3086,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2041,19 +3117,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -2062,42 +3149,61 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "created_at", - "user", - "user_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", "_document_id", - "request_access_security_header" - ] - }, - { - "action": "discussion_comment.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "repo", - "org", - "repo_id", - "request_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "discussion_comment.destroy", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "@timestamp", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2105,20 +3211,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo_id", "@timestamp", - "actor", - "user_agent", - "request_id", - "org", "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "repo", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2126,22 +3242,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "user_agent", - "actor_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "title", - "_document_id", - "created_at", - "repo", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -2149,17 +3274,31 @@ "description": "A global announcement banner was created for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2170,16 +3309,30 @@ "description": "A global announcement banner was removed from the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2190,18 +3343,32 @@ "description": "A global announcement banner was updated for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", "old_message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2212,17 +3379,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was created.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", - "operation_type", "@timestamp", "_document_id", - "org_id", "action", - "request_id", - "org", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -2231,17 +3411,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was deleted.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", + "@timestamp", "_document_id", "action", - "@timestamp", - "actor_id", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -2250,46 +3443,65 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Managing environments for deployment" + }, + { + "action": "environment.create", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2297,28 +3509,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2327,27 +3545,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -2356,25 +3582,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2383,26 +3617,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2411,21 +3652,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -2434,22 +3687,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2458,25 +3721,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "public_repo", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "visibility", + "operation_type", + "created_at", + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2485,22 +3757,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -2509,21 +3793,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -2534,19 +3828,30 @@ "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2555,20 +3860,30 @@ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2577,19 +3892,30 @@ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2598,23 +3924,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2622,18 +3957,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -2644,20 +3989,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2667,25 +4022,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -2693,25 +4058,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -2719,26 +4093,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -2747,25 +4130,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -2773,26 +4165,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -2800,21 +4201,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -2823,19 +4235,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -2843,21 +4268,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -2866,19 +4302,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -2889,47 +4339,70 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", - "actor", - "created_at", "_document_id", - "repository_selection", - "integration", - "user_id", - "user", "action", - "operation_type", - "name", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "repository_selection", + "integration", + "operation_type", + "name", + "application_client_id" + ], + "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2940,23 +4413,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2967,21 +4452,33 @@ "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", "operation_type", - "@timestamp", "integration", - "action", - "user_agent", "reason", - "_document_id", - "org", - "org_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -2992,20 +4489,32 @@ "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ "@timestamp", - "actor_id", - "org", "_document_id", - "requester", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "requester", "created_at", "url", - "org_id", - "request_id", "operation_type", - "actor", "integration", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -3015,20 +4524,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -3038,19 +4560,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -3059,20 +4595,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -3082,20 +4631,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -3104,20 +4666,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -3126,20 +4701,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -3147,19 +4734,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -3168,19 +4768,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -3189,17 +4802,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -3212,21 +4838,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -3240,17 +4879,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -3262,19 +4914,30 @@ "description": "An IP allow list was disabled.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "actor", - "request_id", - "org", - "user_agent", + "@timestamp", "_document_id", - "user_id", + "action", + "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "@timestamp", - "user" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3282,19 +4945,30 @@ "description": "An IP allow list was disabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3302,20 +4976,29 @@ "description": "An IP allow list was enabled.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "business", - "user_id", - "request_id", - "actor", - "user", - "business_id", + "@timestamp", "_document_id", "action", - "@timestamp", - "user_agent", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ] }, @@ -3324,19 +5007,30 @@ "description": "An IP allow list was enabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3344,24 +5038,32 @@ "description": "An IP address was added to an IP allow list.", "docs_reference_links": "N/A", "fields": [ - "active", - "org", - "ip_allow_list_entry", "@timestamp", "_document_id", - "operation_type", - "created_at", - "user_agent", "action", - "request_id", + "actor", "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "business", - "actor", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", + "ip_allow_list_entry", + "operation_type", + "created_at" ] }, { @@ -3369,24 +5071,32 @@ "description": "An IP address was deleted from an IP allow list.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "ip_allow_list_entry", - "org", - "operation_type", - "created_at", - "active", "action", - "@timestamp", + "actor", + "actor_id", "business", "business_id", - "user_agent", + "hashed_token", + "org", "org_id", - "actor", - "actor_id", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ip_allow_list_entry", + "operation_type", + "created_at", + "active" ] }, { @@ -3394,19 +5104,32 @@ "description": "An IP address or its description was changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "actor_id", "ip_allow_list_entry", - "active", - "org_id", - "@timestamp" + "active" ] }, { @@ -3414,22 +5137,31 @@ "description": "A comment on an issue was deleted from the repository.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "org", - "repo", - "actor_id", "@timestamp", - "created_at", "_document_id", "action", - "operation_type", - "user_agent", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "oauth_application_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -3437,24 +5169,30 @@ "description": "A comment on an issue was pinned to a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3465,19 +5203,29 @@ "description": "A comment on an issue was unpinned from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3488,22 +5236,31 @@ "description": "A comment on an issue (other than the initial one) changed.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", - "action", - "repo_id", - "org_id", - "created_at", - "operation_type", "@timestamp", - "user_agent", - "request_id", "_document_id", - "actor_id", + "action", "actor", - "oauth_application_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -3511,20 +5268,30 @@ "description": "An issue was marked as blocked by another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", - "repo", - "repo_id", - "public_repo", - "org", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", + "public_repo", "created_at", "operation_type", "actor_is_bot" @@ -3535,19 +5302,30 @@ "description": "The blocked by relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3557,20 +5335,30 @@ "description": "An issue was marked as blocking another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3581,20 +5369,30 @@ "description": "The blocking relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3605,21 +5403,31 @@ "description": "An issue was deleted from the repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", "fields": [ - "user", - "actor_id", - "created_at", - "title", "@timestamp", "_document_id", - "request_id", - "actor", - "user_id", "action", - "operation_type", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "title", + "operation_type" ], "docs_reference_titles": "Deleting an issue" }, @@ -3628,23 +5436,33 @@ "description": "An issue was pinned to a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ + "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", "action", "actor", - "operation_type", - "owner_type", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "number", - "repo", - "event", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type", + "owner_type", + "number", + "event" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -3653,22 +5471,32 @@ "description": "An issue was transferred to another repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "owner_type", - "actor_id", "number", - "repo", "operation_type", - "_document_id", - "repo_id", - "action", - "request_id", - "created_at", - "actor", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Transferring an issue to another repository" }, @@ -3677,20 +5505,32 @@ "description": "An issue type was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issue_type_name", "description", "color", "enabled", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3701,20 +5541,32 @@ "description": "An issue type was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issue_type_name", "description", "color", "enabled", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3725,12 +5577,29 @@ "description": "An issue type was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "issue_type_name", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "issue_type_name", "description", "color", "enabled", @@ -3738,11 +5607,6 @@ "old_description", "old_color", "old_enabled", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3753,24 +5617,33 @@ "description": "An issue was unpinned from a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ - "event", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", - "action", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "operation_type", - "_document_id", - "number", - "owner_type", - "@timestamp", + "token_id", + "token_scopes", "user", "user_id", - "token_scopes", - "request_access_security_header" + "user_agent", + "event", + "created_at", + "operation_type", + "number", + "owner_type" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -3779,19 +5652,30 @@ "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user_agent", - "action", "@timestamp", - "operation_type", - "request_id", - "actor_id", - "user_id", - "created_at", "_document_id", + "action", "actor", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "org_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3800,18 +5684,29 @@ "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -3821,19 +5716,30 @@ "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user", - "request_id", - "actor", - "business_id", - "action", - "operation_type", - "user_agent", - "created_at", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor_id" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3842,18 +5748,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3861,21 +5779,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -3883,21 +5814,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -3905,22 +5849,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -3928,19 +5885,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "secondary_category", - "operation_type", - "marketplace_listing", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "secondary_category", + "operation_type", + "marketplace_listing", "primary_category", "integration" ] @@ -3950,22 +5920,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -3973,22 +5956,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -3996,20 +5992,30 @@ "description": "The ability for members to publish GitHub Pages sites was disabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4018,20 +6024,30 @@ "description": "The ability for members to publish GitHub Pages sites was enabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4040,21 +6056,30 @@ "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4063,22 +6088,30 @@ "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4087,21 +6120,30 @@ "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4110,22 +6152,30 @@ "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4134,39 +6184,61 @@ "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ + "@timestamp", "_document_id", - "request_id", - "user", - "user_id", - "business", - "operation_type", - "user_agent", + "action", "actor", "actor_id", + "business", "business_id", - "@timestamp", - "created_at", - "action" - ], - "docs_reference_titles": "Enforcing repository management policies in your enterprise" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, { "action": "members_can_delete_repos.disable", "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "request_id", - "org", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "actor", "operation_type", - "org_id", - "action", - "@timestamp", "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -4176,21 +6248,30 @@ "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "action", - "org_id", - "user_id", - "business", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business_id", + "user_id", + "user_agent", "created_at", - "actor", - "org", - "operation_type", - "user_agent" + "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -4201,16 +6282,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -4219,21 +6311,30 @@ "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "created_at", - "user_id", "business_id", - "user", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "org_id", - "@timestamp" + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -4242,19 +6343,30 @@ "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ - "request_id", - "created_at", - "_document_id", - "user_agent", - "user", - "user_id", - "business", - "business_id", - "operation_type", "@timestamp", + "_document_id", "action", "actor", - "actor_id" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -4263,19 +6375,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4283,21 +6407,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4307,16 +6440,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4326,18 +6472,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4347,14 +6506,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -4362,19 +6537,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -4382,18 +6568,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -4401,23 +6599,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -4425,16 +6631,30 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "org_id", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4442,24 +6662,32 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", - "repo_id", "operation_type", - "@timestamp", - "user_agent", "created_at", - "org", - "action", - "_document_id", - "repo", - "actor", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4467,15 +6695,28 @@ "description": "A network configuration for a hosted compute service was created.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -4493,15 +6734,28 @@ "description": "A network configuration for a hosted compute service was deleted.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -4514,15 +6768,28 @@ "description": "A network configuration for a hosted compute service was updated.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -4539,20 +6806,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4561,20 +6840,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4583,20 +6874,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4605,20 +6908,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4627,19 +6942,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4648,20 +6976,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4670,20 +7010,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4692,19 +7044,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4713,17 +7078,28 @@ "description": "An invitation sent to an organization to join an enterprise was accepted.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4734,41 +7110,61 @@ "description": "A billing manager was added to an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "org", - "user_id", "action", - "created_at", - "org_id", - "user", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" - ], - "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" - }, - { - "action": "org.add_disallowed_two_factor_method", - "description": "An organization prevented access to resources by users with the given two-factor method.", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" + }, + { + "action": "org.add_disallowed_two_factor_method", + "description": "An organization prevented access to resources by users with the given two-factor method.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "two_factor_method", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "two_factor_method", "created_at", "operation_type", "actor_is_bot" @@ -4779,21 +7175,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -4802,24 +7208,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4827,21 +7243,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -4849,20 +7275,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -4870,22 +7306,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -4893,20 +7337,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -4914,22 +7368,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -4937,43 +7399,64 @@ "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "new_policy", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "actor_is_bot" - ], - "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" - }, - { - "action": "org.advanced_security_policy_selected_member_disabled", - "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", - "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "new_policy", + "created_at", "operation_type", + "actor_is_bot" + ], + "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" + }, + { + "action": "org.advanced_security_policy_selected_member_disabled", + "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", - "business_id" + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -4982,19 +7465,30 @@ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -5004,15 +7498,28 @@ "description": "Third-party application access for outside collaborators was disabled for the organization.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5023,15 +7530,28 @@ "description": "Third-party application access for outside collaborators was enabled for the organization.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5042,15 +7562,28 @@ "description": "The organization was archived.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5060,17 +7593,30 @@ "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", "fields": [ - "org_id", - "operation_type", "@timestamp", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" }, @@ -5079,21 +7625,32 @@ "description": "An export of the organization's Git events was created.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "start", "end", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" }, @@ -5102,16 +7659,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_agent", - "action", "@timestamp", - "actor_id", - "org_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -5120,18 +7690,31 @@ "description": "An organization owner blocked a user from accessing the organization's repositories.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", "fields": [ - "actor", - "user_agent", - "org_id", - "created_at", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "blocked_user", + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" }, @@ -5140,19 +7723,30 @@ "description": "An invitation for an organization to join an enterprise was revoked", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "org", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "initiated_from" ], "docs_reference_titles": "Adding organizations to your enterprise" @@ -5162,22 +7756,33 @@ "description": "An invitation sent to a user to join an organization was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "email", - "@timestamp", - "actor", - "action", "operation_type", - "user_agent", - "org", "invitation_id", - "_document_id", "created_at", - "invitee_email", - "token_scopes", - "programmatic_access_type" + "invitee_email" ] }, { @@ -5185,19 +7790,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -5205,16 +7821,28 @@ "description": "Cleared two-factor authentication restrictions for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -5225,23 +7853,31 @@ "description": "Autofix for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5249,21 +7885,31 @@ "description": "Autofix for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5271,23 +7917,31 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5295,23 +7949,31 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5319,10 +7981,28 @@ "description": "Enablement for Code Security features on new repositories has been locked for this organization.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "action", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5332,10 +8012,28 @@ "description": "Enablement for Code Security features on new repositories has been unlocked for this organization.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "action", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5345,21 +8043,30 @@ "description": "Code scanning using the default setup was disabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -5368,21 +8075,30 @@ "description": "Code scanning using the default setup was enabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -5391,20 +8107,31 @@ "description": "Access to use Codespaces on internal and private repositories was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "enablement", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "enablement", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization" }, @@ -5413,21 +8140,31 @@ "description": "Ownership and payment for codespaces was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "owner_type", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" }, @@ -5436,16 +8173,29 @@ "description": "A team has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5455,16 +8205,29 @@ "description": "A team has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5474,19 +8237,30 @@ "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -5495,17 +8269,30 @@ "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -5514,21 +8301,30 @@ "description": "A user has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -5536,21 +8332,30 @@ "description": "A user has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -5558,16 +8363,29 @@ "description": "The interaction limit for collaborators only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "request_id", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" @@ -5577,17 +8395,30 @@ "description": "The interaction limit for prior contributors only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "operation_type", "@timestamp", - "created_at", - "user_agent", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", - "actor", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5596,17 +8427,30 @@ "description": "The interaction limit for existing users only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", "_document_id", - "operation_type", - "actor_id", - "org_id", "action", - "created_at", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5616,16 +8460,29 @@ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ "@timestamp", - "created_at", "_document_id", - "actor_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "action", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5634,17 +8491,30 @@ "description": "The interaction limit for prior contributors only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "operation_type", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5653,17 +8523,30 @@ "description": "The interaction limit for existing users only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "actor_id", - "request_id", + "@timestamp", + "_document_id", "action", - "created_at", - "user_agent", "actor", - "_document_id", - "org_id", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5672,22 +8555,30 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" }, @@ -5696,17 +8587,28 @@ "description": "An invitation for an organization to join an enterprise was confirmed.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5717,15 +8619,28 @@ "description": "Server statistics were exported for the organization.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5736,18 +8651,30 @@ "description": "An organization was created.", "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", "fields": [ - "request_id", - "org", - "actor_id", - "actor", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "org_id", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" }, @@ -5756,20 +8683,31 @@ "description": "A GitHub Actions secret was created for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5778,20 +8716,32 @@ "description": "A GitHub Actions variable was created for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5800,21 +8750,33 @@ "description": "A Codespaces or Dependabot secret was created for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -5822,21 +8784,30 @@ "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor_id", - "org_id", - "business", - "action", "@timestamp", - "org", "_document_id", - "business_id", + "action", "actor", - "token_scopes", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "actor_is_bot", "oauth_credential_type", "managed_oauth_access_id", @@ -5852,24 +8823,32 @@ "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", "fields": [ - "user_agent", - "actor", "@timestamp", - "created_at", - "org_id", - "business_id", - "operation_type", - "request_id", "_document_id", "action", + "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", - "token_scopes", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot", "oauth_credential_type", - "request_access_security_header", "managed_oauth_access_id", "managed_token_id", "managed_oauth_scopes", @@ -5883,21 +8862,32 @@ "description": "An owner revoked authorized credentials.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "oauth_application_id", - "org_id", "operation_type", - "action", - "business", - "request_id", "created_at", - "business_id", - "actor_id", - "_document_id", - "user_agent", "oauth_credential_type", "managed_oauth_access_id", "managed_token_id", @@ -5912,18 +8902,30 @@ "description": "An organization was deleted by a user or staff.", "docs_reference_links": "N/A", "fields": [ - "user_agent", "@timestamp", "_document_id", - "created_at", - "actor", - "org_id", - "org", "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5931,20 +8933,30 @@ "description": "Team creation was limited to owners.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "actor", "@timestamp", "_document_id", - "user", - "user_id", "action", - "created_at", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -5953,16 +8965,29 @@ "description": "Third-party application access restrictions for an organization were disabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "org_id", - "action", - "_document_id", - "request_id", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" @@ -5972,19 +8997,30 @@ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -5993,14 +9029,31 @@ "description": "SAML single sign-on was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sso_url", "issuer", - "action", - "@timestamp", - "_document_id", "created_at", - "org", "operation_type" ] }, @@ -6009,21 +9062,30 @@ "description": "Display of IP addresses within audit log events for the organization was disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" }, @@ -6032,17 +9094,30 @@ "description": "A two-factor authentication requirement was disabled for the organization.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "org_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "_document_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6050,19 +9125,30 @@ "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "user", - "action", - "operation_type", "@timestamp", "_document_id", - "created_at", - "user_agent", - "org", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6070,19 +9156,30 @@ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "user", - "action", - "actor_id", - "org_id" + "created_at" ] }, { @@ -6090,19 +9187,30 @@ "description": "Team creation by members was allowed.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "org_id", - "user", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -6111,17 +9219,30 @@ "description": "Third-party application access restrictions for an organization were enabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "operation_type", - "org", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" }, @@ -6130,19 +9251,30 @@ "description": "An organization owner allowed users with read access to create discussions in an organization", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -6151,19 +9283,32 @@ "description": "SAML single sign-on was enabled for the organization.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", - "sso_url", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "@timestamp", - "issuer", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "sso_url", + "created_at", + "issuer" ], "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" }, @@ -6172,21 +9317,30 @@ "description": "Display of IP addresses within audit log events for the organization was enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "business", - "business_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" }, @@ -6195,17 +9349,30 @@ "description": "Two-factor authentication is now required for the organization.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "actor_id", - "action", - "_document_id", - "org", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" }, @@ -6214,17 +9381,30 @@ "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "org_id", - "manager", "@timestamp", - "request_id", - "actor", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "manager", + "operation_type", "created_at" ] }, @@ -6233,18 +9413,31 @@ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", "docs_reference_links": "N/A", "fields": [ - "org_id", "@timestamp", - "org", - "user_agent", - "request_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "manager", "operation_type", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6252,23 +9445,32 @@ "description": "A new user was invited to join an organization.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", "fields": [ - "org", - "user_id", - "invitation_id", - "org_id", - "user", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", - "created_at", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "invitee_email", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitation_id", + "operation_type", + "created_at", + "invitee_email" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" }, @@ -6277,17 +9479,28 @@ "description": "An organization was invited to join an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -6297,19 +9510,30 @@ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6317,19 +9541,30 @@ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "org", - "org_id", - "user_agent", - "actor_id", - "user_id", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6337,19 +9572,31 @@ "description": "Access to an organization was granted for an OAuth App.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "request_id", "actor_id", - "operation_type", - "org_id", - "_document_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" @@ -6359,20 +9606,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -6381,18 +9639,31 @@ "description": "Access was disabled for an OAuth App that was previously approved.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", "fields": [ - "request_id", - "url", - "created_at", - "org_id", - "action", "@timestamp", "_document_id", - "user_agent", - "org", - "operation_type", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", + "operation_type", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" @@ -6402,19 +9673,31 @@ "description": "An organization member requested that an owner grant an OAuth App access to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", + "@timestamp", "_document_id", - "request_id", - "url", - "org_id", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "url", "oauth_application_name" ] }, @@ -6423,20 +9706,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -6446,16 +9740,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "org_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type", - "_document_id", - "org" + "created_at", + "operation_type" ] }, { @@ -6463,20 +9770,31 @@ "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "reason", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "reason", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -6485,20 +9803,30 @@ "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -6507,19 +9835,30 @@ "description": "An organization owner downloaded the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6528,19 +9867,30 @@ "description": "An organization owner generated the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6549,19 +9899,30 @@ "description": "An organization owner printed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6570,19 +9931,30 @@ "description": "An organization owner viewed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "business", - "business_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6591,19 +9963,31 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", "fields": [ - "actor", - "operation_type", "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "actor_is_bot", - "request_access_security_header" + "operation_type", + "created_at", + "actor_is_bot" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -6612,20 +9996,31 @@ "description": "A GitHub Actions secret was removed from an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -6634,21 +10029,31 @@ "description": "A GitHub Actions variable was removed from an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -6657,18 +10062,29 @@ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "user_id", - "user_agent", - "org_id", - "user", - "action", - "_document_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" @@ -6678,19 +10094,29 @@ "description": "Removed a two-factor authentication method restriction for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "two_factor_method", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "two_factor_method", "created_at", "operation_type", "actor_is_bot" @@ -6701,22 +10127,32 @@ "description": "A Codespaces or Dependabot secret was removed from an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -6724,21 +10160,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6746,21 +10191,30 @@ "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ - "org", - "user", - "org_id", - "created_at", - "request_id", "@timestamp", - "action", - "operation_type", - "user_agent", "_document_id", + "action", "actor", "actor_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6768,40 +10222,62 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", - "org", - "team", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "programmatic_access_type" - ] - }, - { - "action": "org.remove_self_hosted_runner", - "description": "A self-hosted runner was removed.", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type" + ] + }, + { + "action": "org.remove_self_hosted_runner", + "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", "fields": [ - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "actor", - "action", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -6810,19 +10286,31 @@ "description": "An organization was renamed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "_document_id", "@timestamp", - "org", + "_document_id", "action", "actor", - "old_login", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_login", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -6830,14 +10318,28 @@ "description": "Triggered when a required workflow is created.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6848,14 +10350,28 @@ "description": "Triggered when a required workflow is deleted.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6866,14 +10382,28 @@ "description": "Triggered when a required workflow is updated.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6884,20 +10414,30 @@ "description": "An organization member was restored.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", "fields": [ - "user", - "actor", - "user_id", + "@timestamp", "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "actor_id", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" }, @@ -6906,18 +10446,29 @@ "description": "A member's linked identity was revoked.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", "user_id", - "@timestamp", - "action", - "actor_id", "user_agent", - "_document_id", - "request_id", + "operation_type", "created_at" ], "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" @@ -6927,19 +10478,30 @@ "description": "A member's SAML session was revoked.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", "fields": [ - "actor_id", - "created_at", - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" }, @@ -6948,21 +10510,33 @@ "description": "A self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" @@ -6972,21 +10546,31 @@ "description": "A self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "business", "business_id", - "programmatic_access_type" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6995,20 +10579,31 @@ "description": "A self-hosted runner group was renamed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7017,23 +10612,33 @@ "description": "The REST API was used to remove a self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -7042,23 +10647,31 @@ "description": "A self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7067,19 +10680,32 @@ "description": "A runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -7088,25 +10714,36 @@ "description": "The configuration of a self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7115,21 +10752,32 @@ "description": "The visibility of a self-hosted runner group was updated via the REST API.", "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", - "visibility", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" }, @@ -7138,10 +10786,28 @@ "description": "Enablement for Secret Protection features on new repositories has been locked for this organization.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "action", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7151,10 +10817,28 @@ "description": "Enablement for Secret Protection features on new repositories has been unlocked for this organization.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "action", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7164,21 +10848,30 @@ "description": "Automatic partner validation checks have been disabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -7188,21 +10881,30 @@ "description": "Automatic partner validation checks have been enabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -7212,20 +10914,30 @@ "description": "A custom pattern was created for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7234,22 +10946,30 @@ "description": "A custom pattern was removed from secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7258,21 +10978,30 @@ "description": "A custom pattern was published for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7281,21 +11010,30 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7304,22 +11042,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7328,21 +11074,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7351,22 +11106,30 @@ "description": "Generic secrets have been disabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -7374,22 +11137,30 @@ "description": "Generic secrets have been enabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -7397,21 +11168,30 @@ "description": "Secret scanning for non-provider patterns was disabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7421,21 +11201,30 @@ "description": "Secret scanning for non-provider patterns was enabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7445,19 +11234,30 @@ "description": "A role or team was added to the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7467,21 +11267,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7491,21 +11300,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7515,19 +11333,30 @@ "description": "A role or team was removed from the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7537,22 +11366,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7561,22 +11398,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7585,22 +11430,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7609,21 +11462,30 @@ "description": "Push protection for secret scanning was disabled.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7632,21 +11494,30 @@ "description": "Push protection for secret scanning was enabled.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7655,22 +11526,30 @@ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7679,22 +11558,30 @@ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7703,12 +11590,28 @@ "description": "The push protection setting was updated for a secret type for your organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "push_protection_setting", "secret_type", "secret_type_display_name", @@ -7721,12 +11624,28 @@ "description": "The push protection pattern configuration was updated for your organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at" ], "docs_reference_titles": "About push protection" @@ -7736,26 +11655,35 @@ "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -7764,26 +11692,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7791,28 +11727,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7820,26 +11764,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7847,32 +11799,66 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", - "org", - "runner_id", - "runner_name", - "action", + "@timestamp", "_document_id", - "operation_type", - "created_at", - "@timestamp" - ], - "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" - }, - { + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_id", + "runner_name", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" + }, + { "action": "org.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -7881,7 +11867,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -7896,18 +11903,28 @@ "description": "The cache retention policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -7919,18 +11936,28 @@ "description": "The cache storage policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -7942,20 +11969,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -7964,16 +12002,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -7984,18 +12035,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -8004,17 +12068,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", "_document_id", - "org_id", - "operation_type", + "action", "actor", "actor_id", - "@timestamp", - "request_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", - "action" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8022,18 +12099,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -8042,18 +12131,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -8062,18 +12164,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -8082,22 +12196,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", "actor_id", - "org_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issuer", - "business", "operation_type", "created_at", - "request_id", - "business_id", - "_document_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8105,21 +12229,32 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Adding organizations to your enterprise" }, @@ -8128,19 +12263,30 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8151,15 +12297,28 @@ "description": "The organization was unarchived.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -8169,19 +12328,32 @@ "description": "A user was unblocked from an organization.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", "fields": [ - "oauth_application_id", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", - "@timestamp", - "request_id", - "created_at", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "blocked_user", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" }, @@ -8190,20 +12362,32 @@ "description": "A GitHub Actions secret was updated for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "created_at", "key", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -8212,23 +12396,34 @@ "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "updated_allowed_types", "old_policy", - "updated_access_policy", - "programmatic_access_type", - "request_access_security_header" + "updated_access_policy" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" }, @@ -8237,20 +12432,32 @@ "description": "A GitHub Actions variable was updated for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -8259,20 +12466,32 @@ "description": "The default repository permission level for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", + "created_at", "permission", - "actor_id", - "old_permission", - "_document_id", - "programmatic_access_type" + "old_permission" ] }, { @@ -8280,18 +12499,30 @@ "description": "The settings policy for immutable releases was updated for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_policy", "new_policy", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8302,22 +12533,33 @@ "description": "A Codespaces or Dependabot secret was updated for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -8326,20 +12568,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -8347,17 +12600,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -8367,20 +12633,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -8389,17 +12666,30 @@ "description": "The name of the default branch was changed for new repositories in the organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" }, @@ -8408,17 +12698,30 @@ "description": "The repository self-hosted runners policy was updated", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_repo_runners_policy", "new_repo_runners_policy", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8429,19 +12732,32 @@ "description": "An organization's SAML provider settings were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "sso_url", - "actor_id", - "operation_type", "@timestamp", - "issuer", - "org", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "operation_type", + "issuer", + "created_at" ] }, { @@ -8449,18 +12765,30 @@ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", "fields": [ - "request_id", - "org_id", - "actor", - "actor_id", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "org", "action", - "@timestamp", - "created_at", - "request_access_security_header" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" }, @@ -8469,21 +12797,31 @@ "description": "An organization's custom property value was manually set for the first time.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8495,21 +12833,31 @@ "description": "An organization's custom property value was deleted.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8521,18 +12869,30 @@ "description": "A default label was created for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", "fields": [ - "request_id", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", - "_document_id", - "action", - "created_at", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" }, @@ -8541,17 +12901,30 @@ "description": "A default label was deleted for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", "fields": [ - "operation_type", - "request_id", - "actor", "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" }, @@ -8560,17 +12933,30 @@ "description": "A default label was edited for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", "fields": [ - "org", - "created_at", "@timestamp", - "actor", + "_document_id", "action", - "user_agent", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" }, @@ -8579,20 +12965,33 @@ "description": "A domain was approved for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "org_id", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" }, @@ -8601,16 +13000,31 @@ "description": "A domain was added to an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "created_at", + "@timestamp", "_document_id", - "domain_name", "action", - "request_id", + "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "domain_name", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8619,14 +13033,29 @@ "description": "A domain was removed from an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", "fields": [ - "action", - "domain_name", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "domain_name", "operation_type", "created_at" ], @@ -8637,34 +13066,62 @@ "description": "A domain was verified for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "operation_type", - "domain_name", "@timestamp", - "user_agent", - "request_id", - "actor", - "action", - "created_at", "_document_id", - "actor_id" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" - }, - { - "action": "organization_moderators.add_team", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "domain_name", + "created_at" + ], + "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + }, + { + "action": "organization_moderators.add_team", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -8674,17 +13131,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -8694,16 +13162,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -8713,20 +13194,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -8734,19 +13225,30 @@ "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor", - "business_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", "user_agent", - "_document_id", "created_at", - "operation_type", - "request_id", - "business" + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -8755,19 +13257,30 @@ "description": "Organization projects were disabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "operation_type", - "@timestamp", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -8776,18 +13289,29 @@ "description": "Organization projects were enabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor_id", - "org_id", - "created_at", - "user_id", - "org", "@timestamp", "_document_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", + "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" @@ -8797,23 +13321,33 @@ "description": "An organization role was assigned to a user or team.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About custom organization roles" }, @@ -8822,25 +13356,32 @@ "description": "A custom organization role was created in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8852,25 +13393,32 @@ "description": "A custom organization role was deleted in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8881,19 +13429,30 @@ "description": "A user or team was unassigned an organization role.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type" ], @@ -8904,26 +13463,33 @@ "description": "A custom organization role was edited in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", "old_role_permissions", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -8936,22 +13502,33 @@ "description": "An organization's default project base role was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_project_base_role", - "new_project_base_role", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_project_base_role", + "new_project_base_role", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8959,20 +13536,31 @@ "description": "An entire package was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" @@ -8982,23 +13570,34 @@ "description": "A package was published or republished to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "ecosystem", "version_count", "is_republished", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -9007,21 +13606,32 @@ "description": "A specific package version was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "version", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "ecosystem", "actor_is_bot" ], @@ -9032,21 +13642,34 @@ "description": "A specific package version was published or republished to a package.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "ecosystem", "package", "version", - "actor_id", - "user_agent", "is_republished", - "actor", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -9055,20 +13678,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -9077,41 +13714,70 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", - "owner_type", - "domain", - "state", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" - }, - { - "action": "pages_protected_domain.verify", - "description": "A GitHub Pages domain was verified for an organization or enterprise.", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", + "owner_type", + "domain", + "state", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + }, + { + "action": "pages_protected_domain.verify", + "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -9120,18 +13786,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9139,16 +13817,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -9156,18 +13848,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -9175,18 +13879,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9197,22 +13914,31 @@ "description": "The configured restriction for access to resources via personal access tokens was disabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9220,22 +13946,31 @@ "description": "The configured restriction for access to resources via personal access tokens was enabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9243,18 +13978,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9265,19 +14013,29 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", "actor_is_bot" ] @@ -9287,18 +14045,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9309,23 +14077,34 @@ "description": "A personal access token expiration limit was set.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "token_expiration", "old_token_expiration", "exempt_administrators", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9333,21 +14112,32 @@ "description": "A personal access token expiration limit was unset.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "programmatic_access_type", - "old_token_expiration", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_token_expiration", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9355,17 +14145,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9376,18 +14179,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9399,17 +14215,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9421,20 +14250,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was created.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9446,20 +14284,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9471,20 +14318,29 @@ "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9496,20 +14352,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9521,15 +14386,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9539,17 +14419,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -9559,15 +14450,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9577,19 +14483,30 @@ "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "action", - "operation_type", "@timestamp", - "business_id", + "_document_id", + "action", + "actor", "actor_id", - "user", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9597,23 +14514,30 @@ "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "created_at", - "actor_id", + "@timestamp", "_document_id", - "actor", - "user", - "repo", "action", - "user_agent", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "request_id", - "user_id", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -9621,23 +14545,30 @@ "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_id", - "operation_type", + "@timestamp", "_document_id", "action", - "@timestamp", - "repo", - "org", - "business", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org_id", - "created_at", - "business_id" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9645,17 +14576,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9665,17 +14607,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9685,17 +14638,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9705,17 +14669,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -9725,17 +14700,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -9745,17 +14733,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9763,25 +14764,36 @@ "description": "A project's base role was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_project_base_role", "new_project_base_role", "project_number", "public_project", - "business", "project_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9789,20 +14801,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -9812,25 +14835,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -9838,20 +14873,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9859,25 +14906,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9885,17 +14944,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -9903,17 +14975,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -9921,18 +15006,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -9941,18 +15038,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -9961,19 +15070,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -9981,17 +15101,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -10003,22 +15136,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -10026,19 +15168,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -10046,17 +15199,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -10064,18 +15230,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -10083,20 +15262,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -10104,18 +15293,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -10124,18 +15325,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -10144,16 +15357,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -10165,21 +15391,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -10187,22 +15425,32 @@ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", "fields": [ - "repo", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "name", "created_at", - "_document_id", "operation_type", - "actor", - "repo_id", - "org", - "request_id", - "actor_id", - "oauth_application_id", - "@timestamp", - "programmatic_access_type" + "oauth_application_id" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" }, @@ -10211,29 +15459,34 @@ "description": "A protected branch allowance was given to a specific user, team or integration.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "authorized_actors", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -10241,24 +15494,32 @@ "description": "Branch protection was enabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "repo_id", - "user_id", "@timestamp", - "user_agent", - "repo", - "name", - "org_id", - "user", "_document_id", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", "created_at", "authorized_actor_names", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -10269,21 +15530,31 @@ "description": "Branch protection was disabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "repo", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", - "request_id", - "repo_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "name", + "operation_type", "created_at", - "_document_id", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -10294,22 +15565,32 @@ "description": "Enforcement of dismissing stale pull requests was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "dismiss_stale_reviews_on_push", - "org_id", - "action", - "created_at", - "request_id", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismiss_stale_reviews_on_push", + "created_at", "operation_type", - "actor", - "repo", - "org", - "name", - "programmatic_access_type" + "name" ] }, { @@ -10317,24 +15598,34 @@ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "actor", - "oauth_application_id", - "authorized_actors_only", - "authorized_actors", - "created_at", - "user_agent", - "name", + "@timestamp", "_document_id", - "org_id", - "request_id", - "@timestamp", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "operation_type", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "authorized_actors_only", + "authorized_actors", + "created_at", + "name", + "operation_type" ] }, { @@ -10342,30 +15633,37 @@ "description": "A branch protection requirement was overridden by a repository administrator.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "actor", "reasons", - "@timestamp", "before", "after", - "actor_id", - "repo", "operation_type", - "user_agent", "branch", "overridden_codes", - "org", - "org_id", - "action", - "_document_id", - "request_id", "referrer", - "business", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "rule_suite_id" ] @@ -10375,28 +15673,36 @@ "description": "A branch update attempt was rejected.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "request_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "branch", "before", "overridden_codes", "after", - "action", "reasons", - "actor_id", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "actor_is_bot", "rule_suite_id" @@ -10407,23 +15713,32 @@ "description": "Branch protection was enforced for repository administrators.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "admin_enforced", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "name", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "action", "repo_id", - "org_id", - "_document_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "admin_enforced", + "operation_type", + "name", + "created_at" ] }, { @@ -10431,22 +15746,32 @@ "description": "Branch deletion was enabled or disabled for a protected branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "operation_type", - "request_id", - "repo", "@timestamp", - "org_id", - "org", - "action", - "allow_deletions_enforcement_level", "_document_id", - "created_at", - "actor_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_deletions_enforcement_level", + "created_at" ] }, { @@ -10454,23 +15779,32 @@ "description": "Force pushes were enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "actor_id", - "name", + "@timestamp", "_document_id", + "action", "actor", - "repo", - "operation_type", - "request_id", - "allow_force_pushes_enforcement_level", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_force_pushes_enforcement_level", + "created_at" ] }, { @@ -10478,24 +15812,33 @@ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "ignore_approvals_from_contributors", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -10504,22 +15847,32 @@ "description": "Required linear commit history was enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "operation_type", "actor", - "linear_history_requirement_enforcement_level", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "linear_history_requirement_enforcement_level", "name", - "org_id", - "repo_id", - "org", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ] }, { @@ -10527,24 +15880,33 @@ "description": "Fork syncing was enabled or disabled for a read-only branch", "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "lock_allows_fetch_and_merge", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -10553,27 +15915,34 @@ "description": "The enforcement of a branch lock was updated.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "enforcement_level", "lock_branch_enforcement_level", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -10582,18 +15951,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -10604,24 +15986,33 @@ "description": "A branch name pattern was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "old_name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "old_name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -10629,25 +16020,32 @@ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", "docs_reference_links": "N/A", "fields": [ - "name", - "org_id", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "@timestamp", + "business", "business_id", - "request_id", - "pull_request_reviews_enforcement_level", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "business", - "user_agent", - "created_at", "repo_id", - "operation_type", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "pull_request_reviews_enforcement_level", + "created_at", + "operation_type" ] }, { @@ -10655,22 +16053,32 @@ "description": "Enforcement of required code owner review was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "created_at", - "require_code_owner_review", - "operation_type", - "name", - "user_agent", - "action", "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "request_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "require_code_owner_review", + "operation_type", + "name" ] }, { @@ -10678,22 +16086,33 @@ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "require_last_push_approval", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" }, @@ -10702,22 +16121,32 @@ "description": "Enforcement of the required number of approvals before merging was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "required_approving_review_count", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "required_approving_review_count", "created_at", - "actor", "operation_type", - "user_agent", - "name", - "org_id", - "action", - "actor_id", - "_document_id", - "org", - "@timestamp", - "programmatic_access_type" + "name" ] }, { @@ -10725,25 +16154,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "user_agent", "@timestamp", "_document_id", - "name", - "repo", "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "business", - "actor_id", - "operation_type", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "required_status_checks_enforcement_level", - "org", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "required_status_checks_enforcement_level" ] }, { @@ -10751,22 +16187,32 @@ "description": "Enforcement of required commit signing was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "name", "@timestamp", - "created_at", "_document_id", - "request_id", - "repo_id", - "org", - "org_id", "action", "actor", "actor_id", - "signature_requirement_enforcement_level", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "programmatic_access_type" + "operation_type", + "name", + "created_at", + "signature_requirement_enforcement_level" ] }, { @@ -10774,22 +16220,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "created_at", - "repo_id", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "name", - "actor", - "repo", "operation_type", - "action", - "strict_required_status_checks_policy", - "programmatic_access_type" + "strict_required_status_checks_policy" ] }, { @@ -10797,23 +16253,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -10822,24 +16289,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -10848,20 +16326,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10870,21 +16362,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -10894,22 +16399,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10918,25 +16435,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10945,23 +16472,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", - "created_at", - "key", - "fingerprint", - "actor_id", "actor", - "title", - "user_agent", - "user_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "read_only", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "key", + "fingerprint", + "title", + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10970,18 +16508,32 @@ "description": "A pull request was closed without being merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" @@ -10991,21 +16543,32 @@ "description": "A pull request was converted to a draft.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" }, @@ -11014,19 +16577,32 @@ "description": "A pull request was created.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -11037,23 +16613,35 @@ "description": "A review was requested on a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -11063,17 +16651,31 @@ "description": "A pull request was marked as in progress.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11081,19 +16683,32 @@ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -11101,19 +16716,32 @@ "description": "A pull request was merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" @@ -11123,21 +16751,32 @@ "description": "A pull request was marked as ready for review.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" }, @@ -11146,27 +16785,34 @@ "description": "A pull request was rebased.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", - "pull_request_url", - "pull_request_title", - "user", - "user_id", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", + "pull_request_url", + "pull_request_title", + "public_repo", + "created_at", + "operation_type" ] }, { @@ -11174,23 +16820,35 @@ "description": "A review request was removed from a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" }, @@ -11199,18 +16857,32 @@ "description": "A pull request was reopened after previously being closed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -11218,19 +16890,31 @@ "description": "A review comment was added to a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "comment_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -11240,20 +16924,31 @@ "description": "A review comment on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", "@timestamp", "_document_id", - "repo", - "created_at", - "request_id", - "comment_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "comment_id", + "operation_type" ] }, { @@ -11261,18 +16956,31 @@ "description": "A review comment on a pull request was changed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "request_id", - "actor_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "_document_id", - "@timestamp", - "comment_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "comment_id" ] }, { @@ -11280,21 +16988,33 @@ "description": "A review on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ] }, { @@ -11302,20 +17022,33 @@ "description": "A review on a pull request was dismissed.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" }, @@ -11324,19 +17057,33 @@ "description": "A review on a pull request was submitted.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" @@ -11346,45 +17093,64 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", - "actor_id", - "user_id", - "created_at", - "user_agent", - "actor", - "action", - "repo", - "visibility", "_document_id", - "previous_visibility", - "programmatic_access_type" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" - }, - { + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility", + "previous_visibility" + ], + "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + }, + { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -11393,25 +17159,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -11420,23 +17193,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -11445,24 +17226,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -11471,23 +17259,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -11497,22 +17293,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -11521,19 +17326,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -11542,24 +17360,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -11568,24 +17396,32 @@ "description": "Autofix for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", - "public_repo", - "org", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "public_repo", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11593,24 +17429,32 @@ "description": "Autofix for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11618,24 +17462,32 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11643,24 +17495,32 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11668,23 +17528,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -11695,17 +17564,29 @@ "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -11715,17 +17596,29 @@ "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -11735,25 +17628,31 @@ "description": "Code scanning using the default setup was disabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -11762,26 +17661,34 @@ "description": "Code scanning using the default setup was enabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "query_suite", "threat_model", - "languages", - "request_access_security_header" + "languages" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -11790,25 +17697,34 @@ "description": "Code scanning using the default setup was updated for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "query_suite", - "threat_model", - "languages", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "query_suite", + "threat_model", + "languages", + "public_repo", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Configuring default setup for code scanning" @@ -11818,19 +17734,30 @@ "description": "GitHub Codespaces was granted trusted repository access to this repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -11839,19 +17766,30 @@ "description": "GitHub Codespaces trusted repository access to this repository was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11859,17 +17797,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11878,15 +17829,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -11897,16 +17861,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11916,17 +17893,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11936,19 +17926,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11957,17 +17958,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11976,27 +17990,33 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "public_repo", + "created_at", + "operation_type" + ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, { @@ -12004,30 +18024,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -12037,20 +18062,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12059,25 +18095,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12086,23 +18130,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -12110,25 +18165,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -12138,23 +18202,32 @@ "description": "A source code archive of a repository was downloaded as a ZIP file.", "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "created_at", "operation_type", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" @@ -12164,24 +18237,32 @@ "description": "The setting for immutable releases was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -12190,20 +18271,30 @@ "description": "The setting for immutable releases was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -12214,23 +18305,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -12238,21 +18339,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -12260,21 +18371,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -12282,22 +18403,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -12305,21 +18435,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -12327,20 +18467,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -12348,22 +18499,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -12371,18 +18531,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -12390,22 +18564,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -12413,21 +18597,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -12435,18 +18629,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -12455,22 +18661,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12479,24 +18694,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12505,23 +18728,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -12529,26 +18762,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -12557,21 +18795,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -12580,25 +18827,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -12606,22 +18859,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -12630,25 +18893,34 @@ "description": "A branch was renamed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "old_branch", - "new_branch", - "default_branch", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "old_branch", + "new_branch", + "default_branch", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch" @@ -12658,19 +18930,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -12678,17 +18961,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -12697,17 +18995,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -12716,7 +19029,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -12731,22 +19065,30 @@ "description": "The cache retention policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -12758,22 +19100,30 @@ "description": "The cache storage policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -12785,23 +19135,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -12811,20 +19170,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -12835,21 +19205,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -12858,22 +19239,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -12882,21 +19273,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -12905,22 +19307,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -12931,16 +19343,27 @@ "fields": [ "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", "created_at", - "actor", - "repo_id", - "action", - "org", - "org_id", - "request_id", - "repo", "operation_type" ] }, @@ -12950,22 +19373,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -12974,23 +19408,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -13000,19 +19444,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -13020,21 +19474,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -13043,24 +19507,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -13068,25 +19541,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -13095,24 +19575,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13121,25 +19611,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -13148,22 +19646,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13172,26 +19679,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -13199,31 +19714,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13232,22 +19754,30 @@ "description": "Someone closed a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", "fields": [ - "actor", - "repo", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "user_agent", - "actor_id", - "request_id", - "action", - "operation_type", - "created_at", - "repo_id", - "_document_id", + "hashed_token", "org", "org_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "About repository security advisories" }, @@ -13256,18 +19786,29 @@ "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "repo", - "org_id", - "actor", + "@timestamp", + "_document_id", "action", - "request_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "_document_id", + "operation_type", "created_at" ] }, @@ -13276,17 +19817,30 @@ "description": "GitHub made a security advisory public in the GitHub Advisory Database.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -13295,21 +19849,30 @@ "description": "GitHub withdrew a security advisory that was published in error.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -13317,18 +19880,30 @@ "description": "Someone opened a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", "repo_id", - "action", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13336,21 +19911,30 @@ "description": "Someone published a security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", "@timestamp", - "actor", - "repo_id", "_document_id", - "repo", - "business_id", - "business", - "request_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "org" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13358,17 +19942,30 @@ "description": "Someone reopened as draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "repo", - "action", + "operation_type", "created_at", - "@timestamp", - "request_id", - "actor_id", - "_document_id", - "actor", - "repo_id", "public_repo" ] }, @@ -13377,21 +19974,30 @@ "description": "Someone edited a draft or published security advisory.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "repo_id", - "org_id", "business", - "actor", - "user_agent", - "created_at", - "_document_id", "business_id", - "repo", - "action", - "operation_type", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13399,24 +20005,30 @@ "description": "Branch protections were disabled for the repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -13425,24 +20037,30 @@ "description": "Branch protections were enabled for this repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -13451,25 +20069,31 @@ "description": "Code security was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -13478,25 +20102,31 @@ "description": "Code security was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -13505,19 +20135,30 @@ "description": "Data use settings were disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "repo_id", - "request_id", - "actor_id", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -13526,21 +20167,30 @@ "description": "Data use settings were enabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "org", - "user_id", - "repo_id", "@timestamp", - "request_id", - "actor", + "_document_id", "action", - "operation_type", - "created_at", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org_id", - "_document_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -13549,23 +20199,30 @@ "description": "The dependency graph was disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "repo_id", - "operation_type", - "user_id", - "repo", + "@timestamp", "_document_id", - "actor", - "user", "action", - "@timestamp", - "org_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", - "request_id", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -13574,24 +20231,31 @@ "description": "The dependency graph was enabled for a private repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "org", - "org_id", - "action", - "repo", "user_id", - "created_at", "user_agent", - "actor_id", - "repo_id", + "created_at", "operation_type", - "actor", - "@timestamp", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13600,19 +20264,29 @@ "description": "Dependency updates on self-hosted runners was disabled.", "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -13623,23 +20297,32 @@ "description": "Dependency updates on self-hosted runners was enabled.", "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners", "fields": [ - "topic", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "topic", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "actor_is_agent" ], @@ -13650,21 +20333,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -13672,21 +20365,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -13694,21 +20397,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -13716,20 +20430,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -13737,21 +20463,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -13759,19 +20496,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -13779,17 +20529,31 @@ "description": "An organization has reached their repository limit.", "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "limit", "count", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -13800,17 +20564,31 @@ "description": "An organization is approaching their repository limit.", "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "limit", "count", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -13821,19 +20599,30 @@ "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", "fields": [ - "request_id", - "created_at", + "@timestamp", "_document_id", "action", - "user_agent", - "user", - "business_id", - "business", - "operation_type", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -13842,20 +20631,30 @@ "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "created_at", "@timestamp", - "repo", - "action", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "repo_id", - "actor", - "request_id", - "programmatic_access_type" + "created_at", + "operation_type" ] }, { @@ -13864,20 +20663,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", "created_at", - "org_id", - "action", - "user_id", - "operation_type", - "_document_id", - "actor_id", - "repo" + "operation_type" ] }, { @@ -13885,31 +20693,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -13918,19 +20734,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -13938,8 +20765,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -13948,23 +20774,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -13989,26 +20824,32 @@ "description": "Automatic partner validation checks have been disabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -14017,26 +20858,32 @@ "description": "Automatic partner validation checks have been enabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -14044,24 +20891,31 @@ "action": "repository_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", - "fields": [ - "user_agent", - "request_id", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14071,23 +20925,30 @@ "description": "A custom pattern was removed from secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14097,24 +20958,31 @@ "description": "A custom pattern was published for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14124,24 +20992,31 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -14150,24 +21025,31 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14177,23 +21059,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14203,23 +21092,31 @@ "description": "Secret scanning was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "public_repo", - "programmatic_access_type" + "public_repo" ], "docs_reference_titles": "About secret scanning" }, @@ -14228,22 +21125,30 @@ "description": "Secret scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14251,25 +21156,31 @@ "description": "Metadata for secret scanning alerts has been disabled at the repository level", "docs_reference_links": "/code-security/secret-scanning/enabling-secret-scanning-features/enabling-extended-metadata-checks-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enabling extended metadata checks for your repository" @@ -14279,24 +21190,32 @@ "description": "Generic secrets have been disabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14304,22 +21223,31 @@ "description": "Generic secrets have been enabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14328,24 +21256,32 @@ "description": "Secret scanning for non-provider patterns was disabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -14354,24 +21290,32 @@ "description": "Secret scanning for non-provider patterns was enabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -14380,19 +21324,31 @@ "description": "A role or team was added to the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -14401,24 +21357,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -14427,24 +21391,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -14453,19 +21425,31 @@ "description": "A role or team was removed from the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -14474,26 +21458,31 @@ "description": "Secret scanning push protection was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "public_repo", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -14502,26 +21491,31 @@ "description": "Secret scanning push protection was enabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -14530,28 +21524,36 @@ "description": "A code security configuration was applied to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14559,27 +21561,35 @@ "description": "A code security configuration failed to attach to the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14587,28 +21597,36 @@ "description": "A code security configuration was removed from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14616,28 +21634,36 @@ "description": "A code security configuration was removed due to a change in repository or enterprise settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14645,19 +21671,29 @@ "description": "Dependabot security updates was disabled.", "docs_reference_links": "/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -14668,27 +21704,31 @@ "description": "Dependabot security updates was enabled.", "docs_reference_links": "/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates", "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "actor_is_agent" ], @@ -14699,20 +21739,30 @@ "description": "The repository visibility change setting was cleared for an organization or enterprise.", "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", "fields": [ - "created_at", + "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", "business", - "action", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business_id", - "@timestamp", "user_agent", - "actor", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise" }, @@ -14721,20 +21771,30 @@ "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org_id", - "created_at", - "user_agent", - "actor", - "actor_id", - "org", - "operation_type", - "_document_id", - "@timestamp", "user_id", - "action", - "request_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14742,19 +21802,30 @@ "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "_document_id", "@timestamp", - "user_agent", - "user", - "created_at", - "org", - "org_id", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14762,29 +21833,37 @@ "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -14793,29 +21872,37 @@ "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -14824,19 +21911,32 @@ "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ - "operation_type", - "request_id", - "repo_id", "@timestamp", - "user_agent", - "alert_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "alert_id", + "created_at", + "alert_number" ], "docs_reference_titles": "About Dependabot alerts" }, @@ -14845,23 +21945,32 @@ "description": "A Dependabot alert was manually dismissed.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "operation_type", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "alert_id", - "actor", - "repo", "created_at", - "org", - "_document_id", - "action", - "actor_id", "dismiss_reason", - "user", "dismiss_comment", "alert_number", "actor_is_bot" @@ -14872,21 +21981,33 @@ "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "public_repo", "owner", - "_document_id", - "@timestamp", "operation_type", - "token_scopes", "alert_number" ] }, @@ -14895,26 +22016,34 @@ "description": "A Dependabot alert was manually reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type", - "business", - "business_id", "public_repo", - "alert_number", - "request_access_security_header" + "alert_number" ] }, { @@ -14922,21 +22051,32 @@ "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", "docs_reference_links": "N/A", "fields": [ - "alert_id", - "repo", - "operation_type", - "action", - "repo_id", - "_document_id", - "user_agent", - "request_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "alert_id", + "operation_type", + "created_at", + "alert_number" ] }, { @@ -14944,21 +22084,35 @@ "description": "A Dependabot alert was withdrawn.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", "created_at", "active", - "action", - "repository_id", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type" ] }, @@ -14967,20 +22121,30 @@ "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", "fields": [ - "org", + "@timestamp", "_document_id", - "repo", - "org_id", - "operation_type", - "created_at", - "actor", "action", - "@timestamp", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" }, @@ -14989,24 +22153,31 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -15014,26 +22185,32 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15041,23 +22218,30 @@ "description": "Dependabot alerts was disabled.", "docs_reference_links": "N/A", "fields": [ - "repo", - "request_id", - "repo_id", - "action", - "actor_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "_document_id", "user_id", - "operation_type", - "token_scopes", - "programmatic_access_type" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -15065,23 +22249,30 @@ "description": "Dependabot alerts was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_agent", - "created_at", "@timestamp", - "repo_id", + "_document_id", "action", - "user", - "repo", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor_id", - "_document_id", - "user_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot" ] }, @@ -15090,24 +22281,31 @@ "description": "A status check was marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "org", - "actor_id", "@timestamp", - "business", - "request_id", - "context", - "repo_id", - "action", - "repo", "_document_id", - "operation_type", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "actor", - "created_at", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "context", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -15116,21 +22314,31 @@ "description": "A status check was no longer marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "actor_id", - "actor", - "created_at", - "context", - "operation_type", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "repo_id", "org_id", - "action", - "_document_id", + "programmatic_access_type", "repo", - "programmatic_access_type" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "context", + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -15139,18 +22347,31 @@ "description": "Email notification restrictions for an organization or enterprise were disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "business", - "business_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -15159,19 +22380,31 @@ "description": "Email notification restrictions for an organization or enterprise were enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -15180,22 +22413,33 @@ "description": "A new custom repository role was created.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "owner", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", - "_document_id", "role_permissions", "old_role_permissions" ], @@ -15206,23 +22450,34 @@ "description": "A custom repository role was deleted.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Managing custom repository roles for an organization" }, @@ -15231,23 +22486,34 @@ "description": "A custom repository role was edited.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "old_role_permissions", "old_base_role" ], @@ -15258,14 +22524,28 @@ "description": "A user was assigned to a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15280,14 +22560,28 @@ "description": "GitHub detected a secret and created a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15301,14 +22595,28 @@ "description": "A secret scanning alert was deleted by GitHub.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15324,14 +22632,28 @@ "description": "A secret scanning alert was leaked in a public repo.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15346,38 +22668,62 @@ "description": "A secret scanning alert was reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type_display_name" ] }, { "action": "secret_scanning_alert.report", "description": "A leaked secret was reported to the secret's provider by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts", - "fields": [ - "repo_id", - "repo", - "actor_id", + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "created_at", @@ -15392,28 +22738,37 @@ "description": "A secret scanning alert was resolved.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "resolution", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", + "resolution", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type", "secret_type_display_name", "publicly_leaked", - "multi_repo", - "request_access_security_header" + "multi_repo" ] }, { @@ -15421,25 +22776,32 @@ "description": "A secret scanning alert was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -15447,14 +22809,28 @@ "description": "A user was unassigned from a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15469,14 +22845,28 @@ "description": "A secret scanning alert was validated.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "previous_validity", @@ -15493,26 +22883,34 @@ "description": "A request to close a secret scanning alert was approved by a user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "request_reviewer_comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15521,25 +22919,33 @@ "description": "N/A", "docs_reference_links": "A reqeust to close a secret scanning alert was canceled by a user.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "A, reqeust, to, close, a, secret, scanning, alert, was, canceled, by, a, user." @@ -15549,27 +22955,35 @@ "description": "N/A", "docs_reference_links": "A user requested to close a secret scanning alert.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "reason", "comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "A, user, requested, to, close, a, secret, scanning, alert." @@ -15579,26 +22993,34 @@ "description": "A request to close a secret scanning alert was denied by a user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "request_reviewer_comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", + "operation_type", "actor_is_bot" ] }, @@ -15607,19 +23029,30 @@ "description": "Secret scanning was disabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -15628,19 +23061,30 @@ "description": "Secret scanning was enabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -15649,20 +23093,30 @@ "description": "Secret scanning was disabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -15671,19 +23125,30 @@ "description": "Secret scanning was enabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -15692,14 +23157,28 @@ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "push_protection_bypass_reason", @@ -15717,25 +23196,33 @@ "description": "A request to bypass secret scanning push protection was approved by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -15744,24 +23231,32 @@ "description": "A user canceled a request to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" @@ -15771,24 +23266,32 @@ "description": "A user pushed a commit containing a secret for which there is an approved secret scanning push protection bypass request.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" @@ -15798,25 +23301,33 @@ "description": "A request to bypass secret scanning push protection was denied by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", - "request_access_security_header", "request_reviewer_comment" ], "docs_reference_titles": "About push protection" @@ -15826,25 +23337,33 @@ "description": "A user requested to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" }, @@ -15853,22 +23372,35 @@ "description": "A secret scanning scan has completed on this repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "repo_id", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "source", "type", "source_slug", "type_slug", "started_at", "completed_at", - "repo", "public_repo", - "org", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "secret_types", @@ -15882,10 +23414,28 @@ "description": "A security configuration was created", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15900,15 +23450,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -15926,22 +23469,33 @@ "description": "A default security configuration setting for new repositories was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15950,22 +23504,33 @@ "description": "A default security configuration setting for new repositories was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15974,10 +23539,28 @@ "description": "A security configuration was deleted", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15992,15 +23575,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -16017,15 +23593,30 @@ "description": "A security configuration policy was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enforcement", "security_configuration_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16035,10 +23626,28 @@ "description": "A security configuration was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -16053,15 +23662,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -16079,16 +23681,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16098,18 +23713,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "org", - "org_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -16118,16 +23746,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16137,15 +23778,28 @@ "description": "An agreement for invoiced billing for GitHub Sponsors was signed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -16157,15 +23811,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -16175,15 +23842,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -16192,17 +23874,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -16211,17 +23906,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -16230,16 +23939,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -16249,14 +23971,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -16266,17 +24003,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -16285,17 +24035,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "created_at", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -16304,18 +24067,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16324,15 +24100,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -16342,16 +24132,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16359,15 +24162,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -16378,16 +24194,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -16397,17 +24226,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -16418,17 +24260,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -16439,18 +24294,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16460,16 +24326,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16479,16 +24358,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "sponsors_listing_id", "created_at", "operation_type" ] @@ -16500,17 +24392,30 @@ "fields": [ "@timestamp", "_document_id", - "fingerprint", - "operation_type", - "openssh_public_key", - "org_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "request_id" + "fingerprint", + "operation_type", + "openssh_public_key", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16519,19 +24424,32 @@ "description": "An SSH certificate authority for an organization or enterprise was deleted.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "created_at", + "@timestamp", "_document_id", - "fingerprint", - "operation_type", + "action", "actor", - "org_id", - "openssh_public_key", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", - "request_id" + "created_at", + "fingerprint", + "operation_type", + "openssh_public_key" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16540,21 +24458,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "user", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "request_id", - "org", - "org_id", - "created_at", - "actor", "action", - "user_id", + "actor", + "actor_id", "business", "business_id", - "@timestamp", - "actor_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16563,19 +24490,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "actor_id", - "user_id", - "org", - "operation_type", - "request_id", "@timestamp", "_document_id", - "actor", - "user", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16584,15 +24522,28 @@ "description": "Dependabot encrypted config was read.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "public_repo" @@ -16603,20 +24554,34 @@ "description": "The verification code expiry time for an organization or enterprise domain was set.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "token_expires_at", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16624,18 +24589,33 @@ "description": "An organization or enterprise domain was unverified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ] }, { @@ -16643,16 +24623,31 @@ "description": "An organization or enterprise domain was verified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "domain_name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16660,23 +24655,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16684,23 +24689,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16708,23 +24723,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16732,23 +24757,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16756,21 +24791,31 @@ "description": "A member of an organization was added to a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", "fields": [ - "user_agent", - "request_id", - "org_id", - "user_id", - "team", - "user", "@timestamp", - "actor_id", - "created_at", - "operation_type", "_document_id", - "org", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" @@ -16780,22 +24825,31 @@ "description": "A team was given access and permissions to a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "team", - "action", - "operation_type", - "request_id", - "created_at", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "actor_id", - "_document_id", "repo_id", - "user_agent", - "org_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -16804,20 +24858,30 @@ "description": "A team was added to an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team_type", "team", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -16828,20 +24892,31 @@ "description": "A child team was created or a child team's parent was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", "fields": [ - "org", "@timestamp", - "created_at", "_document_id", - "team", "action", - "operation_type", "actor", - "request_id", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", + "operation_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" }, @@ -16850,18 +24925,31 @@ "description": "A team's privacy level was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", "fields": [ - "user_agent", - "request_id", - "org", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", "created_at", "operation_type", - "actor_id", - "org_id", - "@timestamp", - "actor", - "_document_id", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" @@ -16871,21 +24959,32 @@ "description": "A new team is created.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "oauth_application_id", + "operation_type", "team", - "org", - "actor", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "team_type" ] }, @@ -16894,21 +24993,31 @@ "description": "A user was demoted from a team maintainer to a team member.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" }, @@ -16917,19 +25026,31 @@ "description": "A team was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "team", "org_id", - "actor_id", - "actor", - "action", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", "operation_type", - "_document_id", - "programmatic_access_type", "team_type" ] }, @@ -16938,19 +25059,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "actor", - "action", - "operation_type", - "team", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "team" ] }, { @@ -16958,19 +25091,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", "@timestamp", - "actor_id", "_document_id", - "team", - "created_at", - "org_id", "action", - "request_id", - "user_agent", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_access_security_header" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "team", + "created_at" ] }, { @@ -16978,22 +25123,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "team", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at" ] }, { @@ -17001,22 +25155,31 @@ "description": "A user was promoted from a team member to a team maintainer.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" }, @@ -17025,20 +25188,30 @@ "description": "A team was removed from an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team_type", "team", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -17049,22 +25222,31 @@ "description": "An organization member was removed from a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", "fields": [ - "request_id", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "team", - "user_id", - "actor", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", + "user_id", "user_agent", - "_document_id", - "token_scopes", - "programmatic_access_type", + "operation_type", + "created_at", + "team", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" @@ -17074,43 +25256,64 @@ "description": "A repository was removed from a team's control.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "org_id", - "repo", - "repo_id", - "action", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "created_at", "team", - "org", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { "action": "team.rename", - "description": "A team's name was changed.", - "docs_reference_links": "N/A", - "fields": [ - "name", - "user_agent", - "created_at", - "team", - "operation_type", - "actor_id", - "org", + "description": "A team's name was changed.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", "action", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "_document_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "team", + "operation_type", "team_type" ] }, @@ -17119,17 +25322,30 @@ "description": "Team synchronization with a tenant was disabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "request_id", - "org_id", "actor_id", - "operation_type", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -17138,19 +25354,30 @@ "description": "Team synchronization with a tenant was enabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ - "org_id", - "business_id", - "actor", - "created_at", - "user_agent", "@timestamp", - "operation_type", - "business", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -17159,19 +25386,30 @@ "description": "The Okta credentials for team synchronization with a tenant were changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -17179,28 +25417,37 @@ "description": "A team's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "team", - "org_id", "@timestamp", - "org", "_document_id", - "old_permission", - "request_id", - "repo", "action", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "old_permission", "operation_type", "created_at", - "user_agent", "permission", "new_repo_permission", "new_repo_base_role", "old_repo_permission", - "old_repo_base_role", - "token_scopes", - "programmatic_access_type" + "old_repo_base_role" ] }, { @@ -17208,23 +25455,38 @@ "description": "Triggered when a user content edit is deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_content_id", "user_content_type", "created_at", - "user_agent", "deleted_by", "editor_id", - "_document_id", "deleted_at", - "action", - "actor_id", "editor", "deleted_by_id", "deleted_content", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -17232,16 +25494,30 @@ "description": "A Dependabot rule was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17251,16 +25527,30 @@ "description": "A Dependabot rule was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17270,18 +25560,31 @@ "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17291,21 +25594,33 @@ "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17313,21 +25628,32 @@ "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -17335,21 +25661,32 @@ "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -17357,16 +25694,30 @@ "description": "A Dependabot rule's conditions, actions, or metadata changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17376,27 +25727,33 @@ "description": "A workflow job was approved.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", - "repo", - "repo_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -17405,23 +25762,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17429,10 +25796,28 @@ "description": "A workflow run was cancelled.", "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17443,20 +25828,9 @@ "run_number", "cancelled_at", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Canceling a workflow run" }, @@ -17465,23 +25839,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17491,10 +25873,28 @@ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17506,19 +25906,9 @@ "conclusion", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -17529,10 +25919,28 @@ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17541,21 +25949,10 @@ "head_branch", "head_sha", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "public_repo", - "programmatic_access_type", "actor_is_bot", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "Understanding GitHub Actions" @@ -17565,23 +25962,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -17590,22 +25999,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -17613,21 +26033,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -17635,25 +26066,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -17661,23 +26100,36 @@ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", "fields": [ - "repo_id", - "repo", - "org_id", - "org", - "business_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "job_name", "runner_labels", "is_hosted_runner", "environment_name", "secrets_passed", - "action", - "_document_id", "operation_type", "created_at", - "@timestamp", "runner_owner_type", "job_workflow_ref", "calling_workflow_refs", @@ -17691,24 +26143,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -17717,10 +26178,28 @@ "description": "A workflow run was re-run.", "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17730,21 +26209,11 @@ "head_sha", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", "rerun_type", "check_run_id", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "Re-running workflows and jobs" @@ -17754,25 +26223,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghec/user.json b/src/audit-logs/data/ghec/user.json index d12883c8b51a..86bcc2b8bf74 100644 --- a/src/audit-logs/data/ghec/user.json +++ b/src/audit-logs/data/ghec/user.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,17 +67,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "request_id", "@timestamp", - "user_agent", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", - "user_id", + "token_scopes", "user", - "actor", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -61,18 +98,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", + "token_scopes", "user", - "request_id", - "_document_id", - "user_agent", - "actor", "user_id", - "actor_id", - "operation_type", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -80,18 +129,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "actor_id", - "operation_type", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "token_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -99,29 +160,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -129,18 +196,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -148,21 +227,34 @@ "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -178,22 +270,34 @@ "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "uuid", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -201,25 +305,37 @@ "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", - "request_access_security_header", "old_target_amount", "old_budget_limit_type", "old_alert_enabled", @@ -233,17 +349,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -252,19 +381,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -273,15 +414,28 @@ "description": "Azure subscription has been linked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -291,15 +445,28 @@ "description": "Azure subscription has been unlinked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -309,18 +476,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -328,16 +508,28 @@ "description": "The premium request paid usage policy for your GitHub account was changed.", "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -349,18 +541,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -368,15 +572,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -386,26 +603,36 @@ "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -413,24 +640,34 @@ "description": "A CSV export was requested on the \"Coverage\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -438,26 +675,36 @@ "description": "A CSV export was requested on the \"Overview Dashboard\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "user", - "user_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -465,20 +712,31 @@ "description": "A CSV export was requested on the \"Risk\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -489,17 +747,29 @@ "description": "The cache retention policy for GitHub Actions was set for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type", "actor_is_bot" @@ -511,17 +781,29 @@ "description": "The cache storage policy for GitHub Actions was set for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type", "actor_is_bot" @@ -533,17 +815,30 @@ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "created_at", "operation_type" ], @@ -554,20 +849,32 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -576,19 +883,32 @@ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "limit", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -597,19 +917,31 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -618,20 +950,32 @@ "description": "The policy for fork pull request workflows was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -640,19 +984,31 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -661,20 +1017,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -683,20 +1050,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -707,17 +1085,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -725,14 +1115,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -742,25 +1147,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -771,22 +1185,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -798,22 +1223,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -822,15 +1258,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -841,17 +1292,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -861,27 +1325,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", "org", - "owner", - "pull_request_id", - "machine_type", - "user_id", - "user", - "devcontainer_path", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "owner", + "pull_request_id", + "machine_type", + "devcontainer_path", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -889,19 +1362,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -909,18 +1395,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -929,23 +1427,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -953,16 +1458,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -971,24 +1490,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -996,15 +1521,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1014,20 +1552,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -1035,19 +1583,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -1055,21 +1615,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1077,22 +1646,33 @@ "description": "Specific repositories were disabled from using Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "owner_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1100,21 +1680,31 @@ "description": "Specific repositories were enabled to use Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "owner_type", - "owner", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1124,20 +1714,32 @@ "description": "Copilot coding agent access was updated for the organization's or user's repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_access", "old_access", - "org_id", "owner_type", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1147,21 +1749,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1171,19 +1782,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1193,21 +1813,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1217,19 +1846,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1238,19 +1878,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1259,19 +1910,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1280,19 +1942,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1301,25 +1974,33 @@ "description": "Dismissal of Dependabot alerts was approved.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -1329,25 +2010,33 @@ "description": "Dismissal request for Dependabot alerts was canceled.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -1357,25 +2046,33 @@ "description": "Dismissal of Dependabot alerts was requested.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -1385,25 +2082,33 @@ "description": "Dismissal of Dependabot alerts was denied.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About Dependabot alerts" @@ -1413,17 +2118,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1431,19 +2149,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1452,19 +2181,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1472,19 +2212,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1493,19 +2244,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1513,19 +2275,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1534,19 +2307,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1554,19 +2338,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1575,20 +2370,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1596,22 +2401,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1620,22 +2434,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1643,28 +2467,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1673,27 +2503,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -1702,25 +2540,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1729,26 +2575,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1757,21 +2610,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1780,22 +2645,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1804,25 +2679,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1831,22 +2715,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1855,21 +2751,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -1880,21 +2786,32 @@ "description": "A gist was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "gist_id", - "@timestamp", "created_at", "operation_type", - "user_agent", - "actor", - "actor_id", - "visibility", - "action", - "_document_id", - "token_scopes", - "programmatic_access_type" + "visibility" ] }, { @@ -1902,42 +2819,65 @@ "description": "A gist was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "gist_id", - "visibility", - "created_at", + "@timestamp", "_document_id", - "user", - "request_id", - "operation_type", + "action", "actor", "actor_id", - "action", - "user_agent", - "@timestamp", - "programmatic_access_type" - ] + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "gist_id", + "visibility", + "created_at", + "operation_type" + ] }, { "action": "gist.visibility_change", "description": "The visibility of a gist was updated.", "docs_reference_links": "N/A", "fields": [ - "action", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", - "user", - "gist_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "visibility", - "user_id", - "created_at", - "_document_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "gist_id", + "visibility", + "created_at" ] }, { @@ -1945,22 +2885,33 @@ "description": "An SSH key was added to a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -1969,23 +2920,34 @@ "description": "An SSH key was removed from a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", "explanation", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -1994,23 +2956,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2018,18 +2989,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -2040,20 +3021,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2063,18 +3054,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "created_at", - "user_id", "@timestamp", - "user", - "operation_type", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -2082,18 +3085,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "created_at", - "_document_id", + "user_id", "user_agent", - "@timestamp", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -2101,25 +3116,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "name", - "events", - "active", - "active_was", - "hook_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "events", + "active", + "active_was", + "hook_id", + "operation_type" ] }, { @@ -2127,25 +3152,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -2153,26 +3187,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -2181,25 +3224,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -2207,26 +3259,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -2234,21 +3295,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -2257,19 +3329,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -2277,21 +3362,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -2300,19 +3396,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -2323,20 +3433,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2346,24 +3468,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2374,23 +3507,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2401,20 +3546,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2424,19 +3582,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -2445,20 +3617,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -2468,20 +3653,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -2490,20 +3688,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -2512,40 +3723,65 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "name", - "integration", - "user", - "user_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", - "request_access_security_header" - ] - }, - { - "action": "integration.revoke_all_tokens", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at" + ] + }, + { + "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2554,19 +3790,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2575,17 +3824,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2598,21 +3860,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -2626,17 +3901,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2648,20 +3936,30 @@ "description": "An issue was marked as blocked by another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -2672,19 +3970,30 @@ "description": "The blocked by relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2694,20 +4003,30 @@ "description": "An issue was marked as blocking another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -2718,20 +4037,30 @@ "description": "The blocking relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", + "public_repo", "created_at", "operation_type", "actor_is_bot" @@ -2742,18 +4071,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2761,21 +4102,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -2783,21 +4137,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -2805,22 +4172,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -2828,19 +4208,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -2851,21 +4244,36 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "actor", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", "marketplace_listing", "has_free_trial", - "user_agent", - "request_id", - "actor_id", "yearly_price_in_cents", "description", "bullets", "monthly_price_in_cents", - "marketplace_listing_plan", - "_document_id" + "marketplace_listing_plan" ] }, { @@ -2873,22 +4281,37 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "marketplace_listing_plan", "marketplace_listing", "description", "bullets", "has_free_trial", "created_at", - "actor_id", "operation_type", - "_document_id", - "action", - "user_agent", - "request_id", - "actor", "monthly_price_in_cents", - "yearly_price_in_cents", - "@timestamp" + "yearly_price_in_cents" ] }, { @@ -2896,21 +4319,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor", - "marketplace_listing_plan", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "marketplace_listing_plan", "description", "yearly_price_in_cents", - "@timestamp", "created_at", - "actor_id", "bullets", "has_free_trial", "marketplace_listing", - "user_agent", "monthly_price_in_cents", - "action", "operation_type" ] }, @@ -2919,45 +4357,73 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "monthly_price_in_cents", - "marketplace_listing", + "@timestamp", "_document_id", "action", - "description", - "bullets", - "yearly_price_in_cents", - "request_id", - "actor_id", - "has_free_trial", - "marketplace_listing_plan", - "user_agent", - "@timestamp", - "operation_type", "actor", - "created_at" - ] - }, - { - "action": "marketplace_listing.redraft", - "description": "A listing was sent back to draft state.", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "monthly_price_in_cents", + "marketplace_listing", + "description", + "bullets", + "yearly_price_in_cents", + "has_free_trial", + "marketplace_listing_plan", + "operation_type", + "created_at" + ] + }, + { + "action": "marketplace_listing.redraft", + "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -2965,22 +4431,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2988,19 +4467,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3008,21 +4499,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3032,16 +4532,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3051,18 +4564,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3072,14 +4598,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -3087,19 +4629,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -3107,42 +4660,62 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "org", - "created_at", - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", - "request_access_security_header" - ] - }, - { + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -3150,20 +4723,30 @@ "description": "An OAuth access token was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", "fields": [ - "_document_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "user", - "user_id", - "created_at", + "_document_id", "action", + "actor", "actor_id", - "request_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" @@ -3174,19 +4757,30 @@ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", "fields": [ "@timestamp", - "user_agent", - "action", - "operation_type", "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_id", + "user_agent", + "operation_type", + "created_at", "explanation", - "hashed_token", - "actor_id", - "token_scopes", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" @@ -3196,19 +4790,30 @@ "description": "An OAuth access token was regenerated.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "_document_id", - "created_at", "@timestamp", - "operation_type", + "_document_id", "action", - "user_agent", - "request_id", "actor", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "oauth_application_name" ] }, @@ -3217,16 +4822,28 @@ "description": "An OAuth access token was revoked.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "request_access_security_header", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -3236,18 +4853,30 @@ "description": "An OAuth access token was updated.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -3255,20 +4884,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3277,20 +4918,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3299,42 +4952,66 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application", - "oauth_application_id", - "user", - "user_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", - "request_access_security_header" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + }, + { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3343,19 +5020,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3364,20 +5054,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3386,20 +5088,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3408,19 +5122,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3429,24 +5156,31 @@ "description": "An authorization for an OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ - "operation_type", - "user_agent", - "user_id", - "actor", - "org_id", + "@timestamp", "_document_id", - "request_id", "action", - "@timestamp", - "created_at", + "actor", "actor_id", - "user", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_is_bot", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -3456,20 +5190,31 @@ "description": "An authorization for an OAuth application was deleted.", "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", "fields": [ - "user_agent", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "actor", "created_at", "explanation", - "user", - "user_id", - "org_id", - "action", - "actor_id", - "token_scopes", "actor_is_bot", "oauth_application_name" ], @@ -3480,20 +5225,31 @@ "description": "An authorization for an OAuth application was updated.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", - "actor_id", "user_agent", - "@timestamp", "operation_type", - "action", - "user", "created_at", - "_document_id", "actor_is_bot", - "request_access_security_header", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -3503,21 +5259,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -3526,24 +5292,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3551,20 +5327,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -3572,22 +5358,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -3595,20 +5389,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -3616,22 +5420,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -3639,21 +5451,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3661,26 +5482,35 @@ "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -3689,26 +5519,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3716,28 +5554,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user", - "user_id", - "query", - "filename", - "requested_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "query", + "filename", + "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3745,26 +5591,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3772,18 +5626,28 @@ "description": "The cache retention policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -3795,18 +5659,28 @@ "description": "The cache storage policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -3818,20 +5692,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -3840,16 +5725,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -3860,18 +5758,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -3880,18 +5791,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -3900,18 +5823,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -3920,18 +5856,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -3941,20 +5889,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -3962,17 +5921,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -3982,20 +5954,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -4004,20 +5987,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -4026,17 +6023,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4047,20 +6059,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -4069,19 +6095,31 @@ "description": "A new passkey was added.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4089,19 +6127,31 @@ "description": "A new passkey was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4109,18 +6159,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4128,35 +6190,61 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" - ] - }, - { - "action": "payment_method.update", - "description": "An existing payment method was updated.", - "docs_reference_links": "N/A", - "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "payment_method.update", + "description": "An existing payment method was updated.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -4164,18 +6252,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4186,18 +6287,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4208,17 +6322,30 @@ "description": "Triggered when you create a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4228,19 +6355,31 @@ "description": "Triggered when you regenerate a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4248,12 +6387,29 @@ "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", "fields": [ - "user_programmatic_access_name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", "operation_type" ], @@ -4264,20 +6420,32 @@ "description": "Triggered when you delete a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "explanation", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4285,17 +6453,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -4306,18 +6487,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -4329,17 +6523,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -4351,17 +6558,30 @@ "description": "A fine-grained personal access token was updated.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4372,15 +6592,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4390,17 +6625,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4410,15 +6656,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4428,17 +6689,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4448,17 +6720,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4468,17 +6751,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4488,17 +6782,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4508,17 +6813,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -4528,38 +6846,62 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "actor", - "user_agent", - "operation_type", - "user", - "created_at", - "user_id", - "action", - "request_id", + "@timestamp", "_document_id", - "@timestamp" - ] + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] }, { "action": "project.close", "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -4569,25 +6911,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -4595,20 +6949,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4616,25 +6982,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4642,17 +7020,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -4660,17 +7051,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -4678,18 +7082,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -4698,18 +7114,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -4718,19 +7146,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -4738,17 +7177,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -4760,22 +7212,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -4783,19 +7244,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -4803,17 +7275,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4821,18 +7306,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -4840,20 +7338,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4861,18 +7369,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -4881,18 +7401,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -4901,16 +7433,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -4922,21 +7467,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", + "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -4944,18 +7501,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4966,23 +7536,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -4991,24 +7572,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -5017,20 +7609,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -5039,21 +7645,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -5063,22 +7682,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -5087,25 +7718,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -5114,23 +7755,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", "key", "fingerprint", - "actor_id", - "actor", "title", - "user_agent", - "user_id", - "request_id", - "read_only", - "token_scopes", - "programmatic_access_type" + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -5139,22 +7791,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -5163,21 +7825,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -5186,25 +7857,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -5213,23 +7891,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -5238,24 +7924,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -5264,23 +7957,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -5290,22 +7991,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -5314,19 +8024,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -5335,24 +8058,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -5361,23 +8094,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -5388,17 +8130,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -5407,15 +8162,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -5426,16 +8194,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -5445,17 +8226,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -5465,19 +8259,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -5486,17 +8291,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -5505,26 +8323,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -5533,30 +8357,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -5566,20 +8395,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5588,25 +8428,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5615,23 +8463,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -5639,25 +8498,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -5667,23 +8535,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -5691,21 +8569,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -5713,21 +8601,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -5735,22 +8633,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -5758,65 +8665,95 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", - "actor", - "actor_id", - "user", - "operation_type", - "repo_id", - "action", - "repo", "_document_id", - "request_access_security_header" - ] - }, - { - "action": "repo.pages_private", - "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id" + "visibility", + "operation_type" ] }, { - "action": "repo.pages_public", - "description": "A GitHub Pages site visibility was changed to public.", + "action": "repo.pages_private", + "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", + "created_at" + ] + }, + { + "action": "repo.pages_public", + "description": "A GitHub Pages site visibility was changed to public.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -5824,18 +8761,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5843,22 +8794,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5866,21 +8827,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -5888,18 +8859,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -5908,22 +8891,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5932,24 +8924,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5958,23 +8958,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -5982,26 +8992,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -6010,21 +9025,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -6033,25 +9057,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -6059,22 +9089,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -6083,19 +9123,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -6103,22 +9154,30 @@ "description": "The cache retention policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -6130,22 +9189,30 @@ "description": "The cache storage policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -6157,46 +9224,66 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "public_repo" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" - }, - { + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", + "created_at", + "operation_type", + "public_repo" + ], + "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + }, + { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -6207,21 +9294,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -6230,22 +9328,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -6254,21 +9362,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -6277,22 +9396,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -6303,16 +9432,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -6321,22 +9461,31 @@ "description": "Temporary access was enabled for a repository.", "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing user-owned repositories in your enterprise" }, @@ -6346,22 +9495,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -6370,23 +9530,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -6396,19 +9566,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -6416,21 +9596,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -6439,24 +9629,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -6464,25 +9663,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -6491,24 +9697,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -6517,25 +9733,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -6544,22 +9768,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -6568,26 +9801,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -6595,31 +9836,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "created_at", - "oauth_application_id", - "user", - "@timestamp", - "repo", - "operation_type", - "request_id", - "org_id", "actor_id", - "visibility", - "old_permission", + "business", + "business_id", + "hashed_token", "org", - "user_id", - "old_base_role", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "visibility", + "old_permission", + "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -6628,21 +9876,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -6650,21 +9908,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -6672,21 +9940,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -6694,20 +9973,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -6715,21 +10006,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -6737,19 +10039,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -6757,31 +10072,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -6790,19 +10113,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -6810,8 +10144,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -6820,23 +10153,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -6861,18 +10203,30 @@ "description": "A security key was registered for an account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "created_at", - "user_id", - "action", - "operation_type", - "request_id", "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -6880,18 +10234,30 @@ "description": "A security key was removed from an account.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "operation_type", - "_document_id", - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6899,14 +10265,28 @@ "description": "A user linked a social identity to their account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -6916,14 +10296,28 @@ "description": "A user unlinked a social identity from their account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "action", - "_document_id", - "@timestamp", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -6933,15 +10327,28 @@ "description": "A user unlinked all social identities from their account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -6951,16 +10358,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6970,18 +10390,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -6990,16 +10423,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -7010,15 +10456,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -7028,16 +10487,31 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", - "user_id", - "@timestamp" - ], + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], "docs_reference_titles": "Downgrading a sponsorship" }, { @@ -7045,17 +10519,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -7064,17 +10551,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -7083,16 +10584,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -7102,14 +10616,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -7119,17 +10648,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -7138,17 +10680,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -7157,18 +10712,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7177,15 +10745,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -7195,16 +10777,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7212,15 +10807,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -7231,16 +10839,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -7250,17 +10871,30 @@ "description": "Triggered when you send an email update to your sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", "fields": [ - "request_id", - "actor", - "action", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" }, @@ -7269,17 +10903,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -7290,17 +10937,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -7311,18 +10971,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -7332,16 +11003,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -7351,17 +11035,30 @@ "description": "You join the waitlist to join GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "actor_id", - "action", "operation_type", - "created_at", - "user", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -7370,16 +11067,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -7389,23 +11099,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7413,23 +11133,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", + "public_repo", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7437,23 +11167,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7461,23 +11201,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7485,15 +11235,30 @@ "description": "Triggered when you accept a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7502,15 +11267,30 @@ "description": "Triggered when you cancel a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7519,15 +11299,30 @@ "description": "Triggered when you create a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7536,15 +11331,30 @@ "description": "Triggered when you decline a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7553,15 +11363,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7569,15 +11394,30 @@ "description": "Triggered when you revoke a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7586,17 +11426,30 @@ "description": "A new trusted device was added.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7604,17 +11457,30 @@ "description": "A trusted device was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7622,14 +11488,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "action", - "request_id", - "user_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -7638,15 +11519,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "created_at", - "user_id", - "operation_type", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action" + "created_at", + "operation_type" ] }, { @@ -7654,13 +11550,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "created_at", - "user_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7668,17 +11581,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "operation_type", - "action", - "_document_id" + "created_at", + "operation_type" ] }, { @@ -7686,17 +11612,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user", - "created_at", - "request_id", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -7704,16 +11643,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7721,15 +11674,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_id", - "action", "@timestamp", - "created_at", - "user_agent", - "user", "_document_id", - "request_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7737,18 +11705,30 @@ "description": "A secondary authentication factor was added to a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -7757,18 +11737,30 @@ "description": "Two-factor authentication was disabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", "fields": [ - "actor", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor_id", + "user_agent", "created_at", - "operation_type", - "request_id", - "@timestamp", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Disabling two-factor authentication for your personal account" }, @@ -7777,18 +11769,30 @@ "description": "Two-factor authentication was enabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ - "actor", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Configuring two-factor authentication" }, @@ -7797,15 +11801,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user", - "user_id", - "action", "@timestamp", - "request_id", "_document_id", - "user_agent" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7813,16 +11832,29 @@ "description": "Two factor recovery codes were regenerated for a user account.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", + "operation_type", "created_at" ] }, @@ -7831,18 +11863,30 @@ "description": "A secondary authentication factor was removed from a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -7851,15 +11895,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "created_at", - "_document_id", - "action", - "@timestamp" + "operation_type", + "created_at" ] }, { @@ -7868,16 +11927,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "operation_type", "user_agent", - "action", - "request_id", - "actor", - "actor_id" + "created_at", + "operation_type" ] }, { @@ -7885,19 +11957,31 @@ "description": "An email address was added to a user account.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", "operation_type", - "_document_id", - "actor_id", - "actor", "email", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding an email address to your GitHub account" }, @@ -7906,18 +11990,30 @@ "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "created_at", - "user", "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -7925,15 +12021,28 @@ "description": "Audit log entries were exported.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "action", - "request_id", - "actor", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", "created_at" ] @@ -7943,20 +12052,31 @@ "description": "A user was blocked by another user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_id", - "_document_id", "actor_id", - "@timestamp", - "user_agent", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -7964,18 +12084,30 @@ "description": "A user changed their password.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "actor_id", - "operation_type", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "created_at", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7983,18 +12115,30 @@ "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -8003,17 +12147,30 @@ "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -8022,19 +12179,31 @@ "description": "A new user account was created.", "docs_reference_links": "N/A", "fields": [ - "email", - "user_id", - "operation_type", "@timestamp", - "request_id", - "user", - "created_at", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "action", - "programmatic_access_type" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "email", + "operation_type", + "created_at" ] }, { @@ -8042,21 +12211,33 @@ "description": "A user secret for Codespaces was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8064,20 +12245,31 @@ "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "user_agent", + "@timestamp", "_document_id", - "operation_type", - "oauth_application_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "@timestamp", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -8085,18 +12277,30 @@ "description": "A user account was destroyed by an asynchronous job.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "request_id", - "user_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8105,19 +12309,30 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "oauth_application_id", + "_document_id", "action", - "user", - "created_at", - "user_agent", - "request_id", "actor", "actor_id", - "operation_type", - "_document_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", + "operation_type" ] }, { @@ -8125,18 +12340,30 @@ "description": "A user deleted his or her account, triggering user.async_delete.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", - "created_at", - "user_agent", "user_id", - "operation_type", - "actor_id", - "action", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8144,37 +12371,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", - "user", - "user_agent", - "user_id", - "actor_id", + "_document_id", "action", - "operation_type", - "request_access_security_header" - ] - }, - { - "action": "user.device_verification_requested", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", - "operation_type", + "user_agent", "created_at", - "_document_id", + "operation_type" + ] + }, + { + "action": "user.device_verification_requested", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "user", - "actor_id", + "_document_id", "action", - "request_access_security_header" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8183,17 +12434,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user", "_document_id", "action", - "operation_type", - "user_agent", - "created_at", - "request_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8201,17 +12464,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8219,17 +12495,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8237,17 +12526,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8255,21 +12557,31 @@ "description": "An enterprise managed user claimed an email address.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8277,21 +12589,31 @@ "description": "N/A", "docs_reference_links": "An enterprise managed user unclaimed an email address.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." }, @@ -8300,17 +12622,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8318,17 +12653,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8336,17 +12684,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8354,18 +12715,30 @@ "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "action", - "operation_type", - "request_id", - "created_at", - "_document_id", "@timestamp", - "user", - "org_id", + "_document_id", + "action", "actor", "actor_id", - "user_agent" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8373,17 +12746,31 @@ "description": "A user requested a password reset.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", "fields": [ - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "email", - "created_at", - "user_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" }, @@ -8392,17 +12779,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "created_at", - "user_agent", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor", - "operation_type", - "request_id" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8410,18 +12810,30 @@ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -8430,19 +12842,31 @@ "description": "A user signed in.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "actor_id", "@timestamp", - "user", - "action", - "operation_type", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "actor", - "passkey_nickname", - "request_access_security_header" + "passkey_nickname" ] }, { @@ -8450,18 +12874,30 @@ "description": "A user signed out.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8469,18 +12905,30 @@ "description": "A user signed in from a new device.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8488,21 +12936,31 @@ "description": "An ordinary user account was promoted to a site administrator.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", + "user_id", "user_agent", + "created_at", "oauth_application_id", - "request_id", - "operation_type", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8510,16 +12968,29 @@ "description": "A user's account was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user", - "action", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "actor", "operation_type" ] }, @@ -8528,20 +12999,31 @@ "description": "An email address was removed from a user account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "actor", - "actor_id", "created_at", - "email", - "token_scopes", - "programmatic_access_type" + "email" ] }, { @@ -8549,20 +13031,32 @@ "description": "A user secret for Codespaces was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "key", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "key", + "integration", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8570,20 +13064,31 @@ "description": "A username was changed.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "request_id", - "actor_id", - "old_login", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "operation_type", "user_agent", - "token_scopes", - "programmatic_access_type" + "old_login", + "created_at", + "operation_type" ] }, { @@ -8591,18 +13096,30 @@ "description": "A user reset their account password.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "@timestamp", - "_document_id", - "actor", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8610,16 +13127,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_id", - "action", "@timestamp", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -8630,16 +13160,28 @@ "fields": [ "@timestamp", "_document_id", - "request_id", - "user_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor_id", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -8648,18 +13190,30 @@ "description": "A user signed in from an unrecognized device.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "created_at", - "actor", - "actor_id", - "@timestamp", - "request_access_security_header" + "created_at" ] }, { @@ -8667,18 +13221,30 @@ "description": "A user signed in from an unrecognized device and location.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "created_at", - "_document_id", - "request_id", - "action", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8686,22 +13252,33 @@ "description": "Triggered when you clear the status on your profile.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "message", - "user", - "actor_id", "created_at", - "request_id", "limited_availability", - "action", "emoji", - "operation_type", - "user_agent", - "@timestamp", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -8709,23 +13286,33 @@ "description": "Triggered when you set or change the status on your profile.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", "fields": [ - "limited_availability", - "user", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "message", - "user_id", - "created_at", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "emoji", - "org", - "actor", - "operation_type", - "token_scopes", - "programmatic_access_type" + "limited_availability", + "message", + "created_at", + "emoji", + "operation_type" ], "docs_reference_titles": "Personalize your profile" }, @@ -8734,21 +13321,31 @@ "description": "A user account was suspended.", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", - "operation_type", - "actor_id", - "user", - "user_agent", - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", - "user_id", + "_document_id", "action", - "token_scopes", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -8756,18 +13353,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", - "actor_id", "@timestamp", - "operation_type", "_document_id", - "user_agent", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8775,18 +13384,30 @@ "description": "A 2FA challenge issued for a user account failed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "_document_id", - "user_agent", - "user", - "actor_id", - "actor", - "user_id", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8796,16 +13417,28 @@ "fields": [ "@timestamp", "_document_id", - "user_id", - "operation_type", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "actor", + "user_id", "user_agent", - "request_id", - "action", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8813,18 +13446,30 @@ "description": "A user used their 2FA recovery codes.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "user_agent", - "request_id", - "user", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "created_at", - "@timestamp", - "_document_id", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8832,18 +13477,30 @@ "description": "A user downloaded 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8851,17 +13508,30 @@ "description": "A user printed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", - "user_agent", - "request_id", - "user_id", - "created_at", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8869,18 +13539,30 @@ "description": "A user viewed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", "created_at", - "user", - "operation_type", - "@timestamp", - "request_id", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -8888,17 +13570,30 @@ "description": "A user was prompted for a two-factor authentication code.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", "fields": [ - "user", - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "actor" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" }, @@ -8907,19 +13602,31 @@ "description": "A user was unblocked by another user.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "actor", - "@timestamp", - "user_agent", - "user_id", - "user", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -8927,21 +13634,31 @@ "description": "A user account was unsuspended.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", - "user", "action", - "user_agent", "actor", - "oauth_application_id", - "operation_type", "actor_id", - "created_at", - "@timestamp", - "user_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -8949,21 +13666,33 @@ "description": "A user secret for Codespaces was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8971,46 +13700,64 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", + "operation_type" + ] + }, + { + "action": "workflows.approve_workflow_job", + "description": "A workflow job was approved.", + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" - ] - }, - { - "action": "workflows.approve_workflow_job", - "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", - "fields": [ "user_agent", - "request_id", - "actor", - "actor_id", "workflow_run_id", "run_number", - "user", - "user_id", - "repo", - "repo_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -9019,23 +13766,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9043,23 +13800,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9069,23 +13834,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -9094,22 +13871,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9117,21 +13905,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -9139,25 +13938,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9165,24 +13972,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -9191,25 +14007,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.14/enterprise.json b/src/audit-logs/data/ghes-3.14/enterprise.json index 52f857ef967f..b49112ba6e3d 100644 --- a/src/audit-logs/data/ghes-3.14/enterprise.json +++ b/src/audit-logs/data/ghes-3.14/enterprise.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,17 +67,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "request_id", "@timestamp", - "user_agent", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", - "user_id", + "token_scopes", "user", - "actor", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -61,18 +98,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", + "token_scopes", "user", - "request_id", - "_document_id", - "user_agent", - "actor", "user_id", - "actor_id", - "operation_type", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -80,18 +129,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "actor_id", - "operation_type", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "token_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -99,29 +160,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -129,31 +196,34 @@ "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests", "fields": [ - "user_agent", - "request_id", - "request_method", - "query_string", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", - "request_body", - "status_code", - "url_path", "business", "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "request_method", + "query_string", + "request_body", + "status_code", + "url_path", + "public_repo", "created_at", "operation_type", "route", @@ -167,18 +237,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -186,20 +268,32 @@ "description": "A manual check of the endpoint configured for audit log streaming was performed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "audit_log_stream_result", - "business_id", "business", - "action", - "_document_id", - "@timestamp", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_result", "created_at", "operation_type", - "audit_log_stream_sink_details", - "request_access_security_header" + "audit_log_stream_sink_details" ] }, { @@ -207,18 +301,31 @@ "description": "An endpoint was added for audit log streaming.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "business_id", "business", - "audit_log_stream_sink", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_sink", + "created_at", + "operation_type", "audit_log_stream_id" ] }, @@ -227,15 +334,28 @@ "description": "An audit log streaming endpoint was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "business_id", "business", - "action", - "_document_id", - "@timestamp", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "audit_log_stream_id", @@ -247,17 +367,30 @@ "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "audit_log_stream_enabled", - "business_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_enabled", "audit_log_stream_sink", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "new_s3_bucket", @@ -280,17 +413,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -299,19 +445,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -320,18 +478,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -339,18 +510,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -358,15 +541,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -376,22 +572,31 @@ "description": "An enterprise owner was added to an enterprise.", "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", "fields": [ - "name", - "business", - "user", - "user_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "request_id", + "business", "business_id", - "_document_id", - "user_agent", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "operation_type" ], "docs_reference_titles": "Inviting people to manage your enterprise" }, @@ -400,22 +605,32 @@ "description": "An organization was added to an enterprise.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "operation_type", "name", "created_at", - "request_id", - "_document_id", - "business", - "organization_upgrade", - "request_access_security_header" + "organization_upgrade" ] }, { @@ -423,20 +638,30 @@ "description": "GitHub Advanced Security was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ - "actor", - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -445,17 +670,28 @@ "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -466,21 +702,31 @@ "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -489,17 +735,28 @@ "description": "GitHub Advanced Security was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -510,17 +767,28 @@ "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -531,21 +799,31 @@ "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -554,20 +832,32 @@ "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "new_policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "new_policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -576,20 +866,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -597,17 +899,28 @@ "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -619,21 +932,31 @@ "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -642,18 +965,31 @@ "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -662,17 +998,30 @@ "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", "fields": [ - "name", - "operation_type", - "business_id", - "user_agent", - "actor_id", - "request_id", - "actor", + "@timestamp", "_document_id", - "business", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -682,19 +1031,32 @@ "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", "business_id", - "action", - "_document_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "business", "visibility", "created_at", - "actor", - "operation_type", - "@timestamp" + "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -703,21 +1065,33 @@ "description": "The policy for Code scanning autofix was updated for an enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -725,19 +1099,31 @@ "description": "An enterprise was created.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", "_document_id", "action", - "@timestamp", - "request_id", - "name", + "actor", + "actor_id", "business", "business_id", - "operation_type", - "actor", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "name", + "operation_type", + "created_at" ] }, { @@ -745,17 +1131,28 @@ "description": "Dependabot alerts were disabled for new repositories in your enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -765,17 +1162,28 @@ "description": "Dependabot alerts were enabled for new repositories in your enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -785,17 +1193,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -805,18 +1226,30 @@ "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -824,17 +1257,28 @@ "description": "Display of IP addresses within audit log events for the enterprise was disabled.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -845,18 +1289,31 @@ "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.", "docs_reference_links": "N/A", "fields": [ - "action", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", "business", - "operation_type", - "created_at", - "user_agent", "business_id", - "actor_id", - "name", - "_document_id", - "request_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "name" ] }, { @@ -864,15 +1321,28 @@ "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -882,17 +1352,28 @@ "description": "Display of IP addresses within audit log events for the enterprise was enabled.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -903,18 +1384,31 @@ "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "operation_type", - "created_at", + "actor_id", "business", "business_id", - "name", - "_document_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "name" ] }, { @@ -922,20 +1416,31 @@ "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", "actor_id", - "@timestamp", - "request_id", "business", - "name", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "business_id", - "_document_id" + "created_at", + "name", + "operation_type" ] }, { @@ -943,20 +1448,31 @@ "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -964,20 +1480,31 @@ "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "name", - "actor", - "operation_type", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "business", - "actor_id", - "created_at", - "action", + "user_id", "user_agent", - "request_id", - "user_id" + "name", + "operation_type", + "created_at" ] }, { @@ -985,20 +1512,31 @@ "description": "An enterprise owner was removed from an enterprise.", "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", - "user_agent", + "actor_id", "business", "business_id", - "@timestamp", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "name", - "actor_id", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", - "user" + "user_agent", + "operation_type", + "created_at", + "name" ], "docs_reference_titles": "Inviting people to manage your enterprise" }, @@ -1007,20 +1545,31 @@ "description": "An organization was removed from an enterprise.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "business", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "business_id", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "name", - "org" + "name" ] }, { @@ -1028,18 +1577,31 @@ "description": "The slug for the enterprise URL was renamed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "name", - "business_id", - "user_agent", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", - "@timestamp", - "created_at", + "actor_id", "business", - "_document_id" + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ] }, { @@ -1047,20 +1609,31 @@ "description": "The SAML single sign-on session for a member in an enterprise was revoked.", "docs_reference_links": "N/A", "fields": [ - "business_id", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "actor", - "_document_id", - "actor_id", "name", - "@timestamp", - "user_id", - "action", - "created_at", - "business" + "created_at" ] }, { @@ -1068,17 +1641,28 @@ "description": "Automatic partner validation checks have been disabled at the business level", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1089,17 +1673,28 @@ "description": "Automatic partner validation checks have been enabled at the business level", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1110,20 +1705,30 @@ "description": "An enterprise-level custom pattern was created for secret scanning.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -1132,17 +1737,28 @@ "description": "An enterprise-level custom pattern was removed from secret scanning.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1152,20 +1768,30 @@ "description": "An enterprise-level custom pattern was published for secret scanning.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1173,17 +1799,28 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1194,20 +1831,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -1216,17 +1863,28 @@ "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1236,17 +1894,28 @@ "description": "Secret scanning was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1257,17 +1926,28 @@ "description": "Secret scanning was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -1278,17 +1958,28 @@ "description": "Secret scanning was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1299,17 +1990,28 @@ "description": "Secret scanning was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1320,17 +2022,28 @@ "description": "Secret scanning for non-provider patterns was disabled at the enterprise level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1342,17 +2055,28 @@ "description": "Secret scanning for non-provider patterns was enabled at the enterprise level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1364,17 +2088,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1385,17 +2120,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1406,17 +2152,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1427,17 +2184,28 @@ "description": "Push protection for secret scanning was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1448,17 +2216,28 @@ "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1469,17 +2248,28 @@ "description": "Push protection for secret scanning was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1490,17 +2280,28 @@ "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -1511,20 +2312,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1532,17 +2345,30 @@ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "created_at", "operation_type" ], @@ -1553,20 +2379,32 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1575,19 +2413,32 @@ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "limit", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1596,19 +2447,31 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1617,20 +2480,32 @@ "description": "The policy for fork pull request workflows was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1639,19 +2514,31 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1660,20 +2547,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "issuer", - "name", - "user_agent", - "action", "@timestamp", "_document_id", + "action", "actor", + "actor_id", "business", "business_id", - "actor_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "issuer", + "name", + "created_at", + "operation_type" ] }, { @@ -1681,46 +2580,72 @@ "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "updated_github_owned_allowed", - "updated_verified_allowed", - "updated_patterns", - "new_policy", - "old_policy", - "updated_access_policy" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { - "action": "business.update_default_repository_permission", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "updated_github_owned_allowed", + "updated_verified_allowed", + "updated_patterns", + "new_policy", + "old_policy", + "updated_access_policy" + ], + "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" + }, + { + "action": "business.update_default_repository_permission", "description": "The base repository permission setting was updated for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", "fields": [ - "business_id", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "permission", - "action", "created_at", - "@timestamp", - "request_id", "name", - "_document_id", - "old_permission", - "business" + "old_permission" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -1729,19 +2654,32 @@ "description": "The repository creation setting was updated for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation", "fields": [ - "created_at", + "@timestamp", "_document_id", - "request_id", - "name", - "business_id", + "action", "actor", "actor_id", - "@timestamp", - "operation_type", - "permission", - "action", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "name", + "operation_type", + "permission", "visibility" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -1751,19 +2689,32 @@ "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories", "fields": [ - "business_id", - "created_at", - "action", - "operation_type", "@timestamp", - "request_id", - "permission", + "_document_id", + "action", "actor", "actor_id", - "name", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "business" + "created_at", + "operation_type", + "permission", + "name" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -1772,20 +2723,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -1794,20 +2756,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -1818,17 +2791,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -1836,14 +2821,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1853,25 +2853,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -1882,22 +2891,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", - "repository", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -1909,22 +2929,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -1933,15 +2964,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -1952,17 +2998,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1972,27 +3031,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "org", "owner", "pull_request_id", "machine_type", - "user_id", - "user", "devcontainer_path", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2000,19 +3068,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -2020,18 +3101,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -2040,23 +3133,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2064,16 +3164,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -2082,40 +3196,59 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "request_access_security_header" - ] - }, - { + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { "action": "copilot.cfb_seat_assignment_reused", "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -2125,20 +3258,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2146,19 +3289,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -2166,21 +3321,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -2188,21 +3352,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2212,19 +3385,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -2234,21 +3416,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2258,18 +3449,31 @@ "description": "A new custom property definition was created.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -2282,18 +3486,31 @@ "description": "A custom property definition was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -2307,14 +3524,29 @@ "description": "A custom property definition was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "value_type", @@ -2327,8 +3559,7 @@ "old_default_value", "old_value_type", "old_values_editable_by", - "values_editable_by", - "request_access_security_header" + "values_editable_by" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2337,27 +3568,35 @@ "description": "A repository's custom property value was manually set for the first time.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2366,19 +3605,31 @@ "description": "A repository's custom property value was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2387,16 +3638,29 @@ "description": "A repository's custom property value was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "definition_id" @@ -2408,19 +3672,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -2429,19 +3704,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -2450,19 +3736,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -2471,19 +3768,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -2492,17 +3800,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2510,40 +3831,62 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependabot_security_updates.enable", - "description": "Dependabot security updates were enabled for all existing repositories.", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + }, + { + "action": "dependabot_security_updates.enable", + "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2551,19 +3894,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -2572,19 +3926,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2592,19 +3957,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -2613,19 +3989,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2633,19 +4020,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -2654,20 +4052,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2675,21 +4083,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "team", - "created_at", - "user_id", "@timestamp", - "number", - "org", - "title", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", "user_agent", - "operation_type", - "_document_id" + "team", + "created_at", + "number", + "title", + "operation_type" ] }, { @@ -2697,18 +4117,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user_id", - "actor", "number", - "user", - "created_at", - "request_id", - "_document_id" + "created_at" ] }, { @@ -2716,18 +4149,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "action", - "_document_id", - "request_id", - "org", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org_id", "user_agent", - "actor", + "operation_type", "number", "team", "created_at" @@ -2738,21 +4182,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "_document_id", - "title", - "user", - "user_agent", - "org", - "operation_type", - "actor_id", "@timestamp", - "actor", - "team", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", + "title", + "operation_type", + "team", "number" ] }, @@ -2761,17 +4216,31 @@ "description": "A global announcement banner was created for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2782,16 +4251,30 @@ "description": "A global announcement banner was removed from the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2802,18 +4285,32 @@ "description": "A global announcement banner was updated for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", "old_message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2824,23 +4321,31 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise" }, @@ -2849,19 +4354,33 @@ "description": "A domain was approved for an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -2870,18 +4389,33 @@ "description": "A domain was added to an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -2890,18 +4424,33 @@ "description": "A domain was removed from an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -2910,18 +4459,33 @@ "description": "A domain was verified for an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -2930,18 +4494,30 @@ "description": "A new GitHub Actions self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -2950,20 +4526,30 @@ "description": "A GitHub Actions self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -2972,18 +4558,31 @@ "description": "A GitHub Actions self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows" ], "docs_reference_titles": "Removing self-hosted runners" @@ -2993,18 +4592,31 @@ "description": "A GitHub Actions self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3013,20 +4625,33 @@ "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -3035,19 +4660,31 @@ "description": "A GitHub Actions self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3056,19 +4693,32 @@ "description": "A GitHub Actions runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -3077,24 +4727,36 @@ "description": "The configuration of a GitHub Actions self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3103,14 +4765,32 @@ "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -3119,14 +4799,32 @@ "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -3135,18 +4833,36 @@ "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", "target_version", "runner_group_id", "runner_group_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Self-hosted runners" }, @@ -3155,22 +4871,32 @@ "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "business_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "user", - "business", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3178,21 +4904,33 @@ "description": "A license for GitHub Copilot was assigned to an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3200,17 +4938,30 @@ "description": "A license for GitHub Copilot was unassigned from an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "business_id", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3221,17 +4972,30 @@ "description": "A new enterprise team was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3241,17 +5005,30 @@ "description": "An enterprise team was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3262,22 +5039,32 @@ "description": "A member was removed from the enterprise team or an IdP group linked to an enterprise team, or an IdP group was unlinked from an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "business_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "user", - "business", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3285,18 +5072,31 @@ "description": "The name of an enterprise team was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "business_id", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3307,22 +5107,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3331,22 +5140,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3354,28 +5173,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3384,27 +5209,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -3413,25 +5246,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3440,26 +5281,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3468,21 +5316,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -3491,22 +5351,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3515,25 +5385,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3542,22 +5421,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -3566,21 +5457,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -3591,27 +5492,33 @@ "description": "A user was added to an external group.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "external_group", - "external_group_id", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "external_group", + "external_group_id", "created_at", "operation_type", - "business", - "business_id", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -3619,19 +5526,31 @@ "description": "An external group was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at", "scim_group_id" ] }, @@ -3640,22 +5559,33 @@ "description": "An external group was linked to a GitHub team.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "external_group", - "programmatic_access_type", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -3663,21 +5593,31 @@ "description": "An external group was created.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -3685,26 +5625,32 @@ "description": "A user was removed from an external group.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "external_group", - "external_group_id", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "external_group", + "external_group_id", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -3712,15 +5658,29 @@ "description": "Failed external group SCIM API request.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", @@ -3728,15 +5688,9 @@ "url_path", "scim_group_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -3745,30 +5699,38 @@ "description": "Successful external group SCIM API request. Excludes GET API requests.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", "status_code", "url_path", "scim_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -3777,18 +5739,31 @@ "description": "An external group was unlinked to a GitHub team.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "external_group" ] }, @@ -3797,22 +5772,32 @@ "description": "An external group was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "scim_group_id", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at", + "scim_group_id" ] }, { @@ -3820,25 +5805,33 @@ "description": "An external group's display name was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", "external_group", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -3846,20 +5839,31 @@ "description": "An external identity was deprovisioned, suspending the linked GitHub user.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "user_id", - "operation_type", "@timestamp", - "created_at", "_document_id", - "token_scopes", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -3867,17 +5871,31 @@ "description": "An external identity was created and linked to a GitHub user.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "scim_user_id", - "request_access_security_header" + "scim_user_id" ] }, { @@ -3885,15 +5903,29 @@ "description": "Failed external identity SCIM API request.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", @@ -3901,15 +5933,9 @@ "url_path", "scim_user_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -3918,30 +5944,38 @@ "description": "Successful external identity SCIM API request. Excludes GET API requests.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", "status_code", "url_path", "scim_user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -3950,18 +5984,31 @@ "description": "An external identity was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "scim_user_id", - "request_access_security_header" + "scim_user_id" ] }, { @@ -3969,21 +6016,32 @@ "description": "A gist was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "gist_id", - "@timestamp", "created_at", "operation_type", - "user_agent", - "actor", - "actor_id", - "visibility", - "action", - "_document_id", - "token_scopes", - "programmatic_access_type" + "visibility" ] }, { @@ -3991,20 +6049,32 @@ "description": "A gist was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "gist_id", - "visibility", - "created_at", + "@timestamp", "_document_id", - "user", - "request_id", - "operation_type", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "@timestamp", - "programmatic_access_type" + "gist_id", + "visibility", + "created_at", + "operation_type" ] }, { @@ -4012,21 +6082,32 @@ "description": "The visibility of a gist was updated.", "docs_reference_links": "N/A", "fields": [ - "action", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", - "user", - "gist_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "visibility", - "user_id", - "created_at", - "_document_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "gist_id", + "visibility", + "created_at" ] }, { @@ -4034,19 +6115,30 @@ "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4055,20 +6147,30 @@ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4077,19 +6179,30 @@ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4098,22 +6211,33 @@ "description": "An SSH key was added to a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -4122,23 +6246,34 @@ "description": "An SSH key was removed from a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", "explanation", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -4147,23 +6282,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4171,18 +6315,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -4193,20 +6347,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -4216,18 +6380,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "created_at", - "user_id", "@timestamp", - "user", - "operation_type", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -4235,18 +6411,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "created_at", - "_document_id", + "user_id", "user_agent", - "@timestamp", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -4254,25 +6442,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -4280,25 +6478,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -4306,26 +6513,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -4334,25 +6550,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -4360,26 +6585,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -4387,21 +6621,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -4410,19 +6655,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -4430,21 +6688,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -4453,19 +6722,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -4476,20 +6759,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", - "integration", - "user_id", - "user", - "action", + "integration", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -4499,24 +6794,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -4527,23 +6833,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -4554,20 +6872,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -4577,19 +6908,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -4598,20 +6943,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -4621,20 +6979,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -4643,20 +7014,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -4665,40 +7049,65 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", + "operation_type", + "created_at" + ] + }, + { + "action": "integration.revoke_all_tokens", + "description": "All user tokens for a GitHub App were requested to be revoked.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" - ] - }, - { - "action": "integration.revoke_all_tokens", - "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A", - "fields": [ "user_agent", - "request_id", - "actor", - "actor_id", "name", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -4707,19 +7116,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -4728,17 +7150,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -4751,21 +7186,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -4779,17 +7227,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -4801,19 +7262,30 @@ "description": "An IP allow list was disabled.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "actor", - "request_id", - "org", - "user_agent", + "@timestamp", "_document_id", - "user_id", + "action", + "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "@timestamp", - "user" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4821,19 +7293,30 @@ "description": "An IP allow list was disabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -4841,17 +7324,28 @@ "description": "IP allow list user level enforcement was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4861,20 +7355,29 @@ "description": "An IP allow list was enabled.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "user_id", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "business_id", - "_document_id", - "action", - "@timestamp", + "user_id", "user_agent", - "actor_id", "operation_type", - "org", "created_at" ] }, @@ -4883,19 +7386,30 @@ "description": "An IP allow list was enabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "created_at", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -4903,17 +7417,28 @@ "description": "IP allow list user level enforcement was enabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4923,24 +7448,32 @@ "description": "An IP address was added to an IP allow list.", "docs_reference_links": "N/A", "fields": [ - "active", - "org", - "ip_allow_list_entry", "@timestamp", "_document_id", - "operation_type", - "created_at", - "user_agent", "action", - "request_id", + "actor", "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "business", - "actor", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", + "ip_allow_list_entry", + "operation_type", + "created_at" ] }, { @@ -4948,24 +7481,32 @@ "description": "An IP address was deleted from an IP allow list.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "ip_allow_list_entry", - "org", - "operation_type", - "created_at", - "active", "action", - "@timestamp", + "actor", + "actor_id", "business", "business_id", - "user_agent", + "hashed_token", + "org", "org_id", - "actor", - "actor_id", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ip_allow_list_entry", + "operation_type", + "created_at", + "active" ] }, { @@ -4973,19 +7514,32 @@ "description": "An IP address or its description was changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "actor_id", "ip_allow_list_entry", - "active", - "org_id", - "@timestamp" + "active" ] }, { @@ -4993,18 +7547,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5012,21 +7578,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -5034,21 +7613,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -5056,22 +7648,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -5079,19 +7684,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "org_id", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -5102,21 +7720,36 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "actor", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", "marketplace_listing", "has_free_trial", - "user_agent", - "request_id", - "actor_id", "yearly_price_in_cents", "description", "bullets", "monthly_price_in_cents", - "marketplace_listing_plan", - "_document_id" + "marketplace_listing_plan" ] }, { @@ -5124,22 +7757,37 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "marketplace_listing_plan", "marketplace_listing", "description", "bullets", "has_free_trial", "created_at", - "actor_id", "operation_type", - "_document_id", - "action", - "user_agent", - "request_id", - "actor", "monthly_price_in_cents", - "yearly_price_in_cents", - "@timestamp" + "yearly_price_in_cents" ] }, { @@ -5147,21 +7795,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor", - "marketplace_listing_plan", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "marketplace_listing_plan", "description", "yearly_price_in_cents", - "@timestamp", "created_at", - "actor_id", "bullets", "has_free_trial", "marketplace_listing", - "user_agent", "monthly_price_in_cents", - "action", "operation_type" ] }, @@ -5170,21 +7833,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "monthly_price_in_cents", - "marketplace_listing", + "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "monthly_price_in_cents", + "marketplace_listing", "description", "bullets", "yearly_price_in_cents", - "request_id", - "actor_id", "has_free_trial", "marketplace_listing_plan", - "user_agent", - "@timestamp", "operation_type", - "actor", "created_at" ] }, @@ -5193,22 +7871,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -5216,22 +7907,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -5239,19 +7943,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5259,21 +7975,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5283,16 +8008,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5302,18 +8040,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5323,14 +8074,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -5338,19 +8105,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -5358,18 +8136,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5377,23 +8167,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -5401,20 +8199,30 @@ "description": "An OAuth access token was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", "fields": [ - "_document_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "user", - "user_id", - "created_at", + "_document_id", "action", + "actor", "actor_id", - "request_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" @@ -5425,19 +8233,30 @@ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", "fields": [ "@timestamp", - "user_agent", - "action", - "operation_type", "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_id", + "user_agent", + "operation_type", + "created_at", "explanation", - "hashed_token", - "actor_id", - "token_scopes", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" @@ -5447,19 +8266,30 @@ "description": "An OAuth access token was regenerated.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "_document_id", - "created_at", "@timestamp", - "operation_type", + "_document_id", "action", - "user_agent", - "request_id", "actor", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "oauth_application_name" ] }, @@ -5468,18 +8298,30 @@ "description": "An OAuth access token was updated.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -5487,20 +8329,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5509,20 +8363,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5531,20 +8397,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5553,20 +8431,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5575,19 +8465,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5596,20 +8499,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5618,20 +8533,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5641,18 +8568,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user_agent", - "org_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "oauth_application_id", - "action", "created_at", - "actor", - "actor_id", - "oauth_application", - "_document_id", - "request_id" + "oauth_application" ] }, { @@ -5660,36 +8600,66 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", "oauth_application", - "actor_id", - "oauth_application_id", + "oauth_application_id" + ], + "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + }, + { + "action": "oauth_application.unsuspend", + "description": "An OAuth application was unsuspended for a user or organization account.", + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.unsuspend", - "description": "An OAuth application was unsuspended for a user or organization account.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ + "user_id", + "user_agent", "operation_type", - "org_id", - "action", "oauth_application_id", "oauth_application", - "org", - "created_at", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5698,24 +8668,31 @@ "description": "An authorization for an OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ - "operation_type", - "user_agent", - "user_id", - "actor", - "org_id", + "@timestamp", "_document_id", - "request_id", "action", - "@timestamp", - "created_at", + "actor", "actor_id", - "user", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_is_bot", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -5725,20 +8702,31 @@ "description": "An authorization for an OAuth application was deleted.", "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", "fields": [ - "user_agent", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "actor", "created_at", "explanation", - "user", - "user_id", - "org_id", - "action", - "actor_id", - "token_scopes", "actor_is_bot", "oauth_application_name" ], @@ -5749,20 +8737,31 @@ "description": "An authorization for an OAuth application was updated.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", - "actor_id", "user_agent", - "@timestamp", "operation_type", - "action", - "user", "created_at", - "_document_id", "actor_is_bot", - "request_access_security_header", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -5772,17 +8771,28 @@ "description": "An invitation sent to an organization to join an enterprise was accepted.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5793,20 +8803,30 @@ "description": "A billing manager was added to an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "org", - "user_id", "action", - "created_at", - "org_id", - "user", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" }, @@ -5815,21 +8835,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -5838,24 +8868,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5863,21 +8903,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -5885,20 +8935,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "org", - "org_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -5906,22 +8966,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -5929,20 +8997,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -5950,22 +9028,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -5973,19 +9059,30 @@ "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -5994,19 +9091,30 @@ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -6016,16 +9124,29 @@ "description": "A user initiated a background job to delete an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "@timestamp", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "created_at" ] }, @@ -6034,16 +9155,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_agent", - "action", "@timestamp", - "actor_id", - "org_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -6052,18 +9186,31 @@ "description": "An organization owner blocked a user from accessing the organization's repositories.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", "fields": [ - "actor", - "user_agent", - "org_id", - "created_at", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "blocked_user", + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" }, @@ -6072,19 +9219,30 @@ "description": "An invitation for an organization to join an enterprise was revoked", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "initiated_from" ], "docs_reference_titles": "Adding organizations to your enterprise" @@ -6094,22 +9252,33 @@ "description": "An invitation sent to a user to join an organization was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "email", - "@timestamp", - "actor", - "action", "operation_type", - "user_agent", - "org", "invitation_id", - "_document_id", "created_at", - "invitee_email", - "token_scopes", - "programmatic_access_type" + "invitee_email" ] }, { @@ -6117,19 +9286,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -6137,23 +9317,31 @@ "description": "Autofix for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6161,21 +9349,31 @@ "description": "Autofix for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6183,21 +9381,30 @@ "description": "Code scanning using the default setup was disabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -6206,21 +9413,30 @@ "description": "Code scanning using the default setup was enabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -6229,16 +9445,29 @@ "description": "The interaction limit for collaborators only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "request_id", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" @@ -6248,17 +9477,30 @@ "description": "The interaction limit for prior contributors only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "operation_type", "@timestamp", - "created_at", - "user_agent", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", - "actor", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6267,17 +9509,30 @@ "description": "The interaction limit for existing users only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", "_document_id", - "operation_type", - "actor_id", - "org_id", "action", - "created_at", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6287,16 +9542,29 @@ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ "@timestamp", - "created_at", "_document_id", - "actor_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "action", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6305,17 +9573,30 @@ "description": "The interaction limit for prior contributors only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org_id", - "action", - "operation_type", - "@timestamp", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "_document_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6324,17 +9605,30 @@ "description": "The interaction limit for existing users only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "actor_id", - "request_id", + "@timestamp", + "_document_id", "action", - "created_at", - "user_agent", "actor", - "_document_id", - "org_id", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6343,22 +9637,30 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" }, @@ -6367,17 +9669,28 @@ "description": "An invitation for an organization to join an enterprise was confirmed.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6388,18 +9701,30 @@ "description": "An organization was created.", "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", "fields": [ - "request_id", - "org", - "actor_id", - "actor", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "org_id", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" }, @@ -6408,18 +9733,30 @@ "description": "An organization was deleted by a user or staff.", "docs_reference_links": "N/A", "fields": [ - "user_agent", "@timestamp", "_document_id", - "created_at", - "actor", - "org_id", - "org", "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6427,20 +9764,30 @@ "description": "Team creation was limited to owners.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "actor", "@timestamp", "_document_id", - "user", - "user_id", "action", - "created_at", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -6449,19 +9796,30 @@ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -6470,14 +9828,31 @@ "description": "SAML single sign-on was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sso_url", "issuer", - "action", - "@timestamp", - "_document_id", "created_at", - "org", "operation_type" ] }, @@ -6486,37 +9861,61 @@ "description": "A two-factor authentication requirement was disabled for the organization.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "org_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "_document_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { "action": "org.display_commenter_full_name_disabled", - "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", - "docs_reference_links": "N/A", - "fields": [ - "actor", - "user_id", - "user", - "action", - "operation_type", + "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", "_document_id", - "created_at", - "user_agent", - "org", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6524,19 +9923,30 @@ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "user", - "action", - "actor_id", - "org_id" + "created_at" ] }, { @@ -6544,19 +9954,30 @@ "description": "Team creation by members was allowed.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "org_id", - "user", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -6565,19 +9986,30 @@ "description": "An organization owner allowed users with read access to create discussions in an organization", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -6586,19 +10018,32 @@ "description": "SAML single sign-on was enabled for the organization.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", - "sso_url", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "@timestamp", - "issuer", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "sso_url", + "created_at", + "issuer" ], "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" }, @@ -6607,17 +10052,30 @@ "description": "Two-factor authentication is now required for the organization.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "actor_id", - "action", - "_document_id", - "org", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" }, @@ -6626,17 +10084,30 @@ "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "org_id", - "manager", "@timestamp", - "request_id", - "actor", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "manager", + "operation_type", "created_at" ] }, @@ -6645,18 +10116,31 @@ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", "docs_reference_links": "N/A", "fields": [ - "org_id", "@timestamp", - "org", - "user_agent", - "request_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "manager", "operation_type", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6664,23 +10148,32 @@ "description": "A new user was invited to join an organization.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", "fields": [ - "org", - "user_id", - "invitation_id", - "org_id", - "user", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", - "created_at", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "invitee_email", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitation_id", + "operation_type", + "created_at", + "invitee_email" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" }, @@ -6689,17 +10182,28 @@ "description": "An organization was invited to join an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -6709,19 +10213,30 @@ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6729,19 +10244,30 @@ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "org", - "org_id", - "user_agent", - "actor_id", - "user_id", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6750,16 +10276,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "org_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type", - "_document_id", - "org" + "created_at", + "operation_type" ] }, { @@ -6767,17 +10306,30 @@ "description": "An organization was restored.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "org_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6785,19 +10337,31 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", "fields": [ - "actor", - "operation_type", "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "actor_is_bot", - "request_access_security_header" + "operation_type", + "created_at", + "actor_is_bot" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -6806,18 +10370,29 @@ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "user_id", - "user_agent", - "org_id", - "user", - "action", - "_document_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" @@ -6827,21 +10402,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6849,21 +10433,30 @@ "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ - "org", - "user", - "org_id", - "created_at", - "request_id", "@timestamp", - "action", - "operation_type", - "user_agent", "_document_id", + "action", "actor", "actor_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6871,21 +10464,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -6893,18 +10496,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", "fields": [ - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "actor", - "action", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -6913,19 +10528,31 @@ "description": "An organization was renamed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "_document_id", "@timestamp", - "org", + "_document_id", "action", "actor", - "old_login", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_login", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -6933,20 +10560,30 @@ "description": "An organization member was restored.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", "fields": [ - "user", - "actor", - "user_id", + "@timestamp", "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "actor_id", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" }, @@ -6955,21 +10592,33 @@ "description": "A self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" @@ -6979,21 +10628,31 @@ "description": "A self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7002,23 +10661,33 @@ "description": "The REST API was used to remove a self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -7027,23 +10696,31 @@ "description": "A self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7052,19 +10729,32 @@ "description": "A runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -7073,25 +10763,36 @@ "description": "The configuration of a self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7100,21 +10801,30 @@ "description": "Automatic partner validation checks have been disabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -7124,21 +10834,30 @@ "description": "Automatic partner validation checks have been enabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -7148,20 +10867,30 @@ "description": "A custom pattern was created for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7170,22 +10899,30 @@ "description": "A custom pattern was removed from secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7194,21 +10931,30 @@ "description": "A custom pattern was published for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7217,21 +10963,30 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7240,22 +10995,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7264,21 +11027,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7287,21 +11059,30 @@ "description": "Secret scanning for non-provider patterns was disabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7311,21 +11092,30 @@ "description": "Secret scanning for non-provider patterns was enabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7335,19 +11125,30 @@ "description": "A role or team was added to the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7357,21 +11158,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7381,21 +11191,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7405,19 +11224,30 @@ "description": "A role or team was removed from the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7427,22 +11257,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7451,22 +11289,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7475,22 +11321,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7499,21 +11353,30 @@ "description": "Push protection for secret scanning was disabled.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7522,21 +11385,30 @@ "description": "Push protection for secret scanning was enabled.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7545,22 +11417,30 @@ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7569,22 +11449,30 @@ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7593,15 +11481,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -7610,15 +11515,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -7627,7 +11549,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -7642,20 +11585,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -7664,16 +11618,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -7684,18 +11651,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -7704,17 +11684,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", "_document_id", - "org_id", - "operation_type", + "action", "actor", "actor_id", - "@timestamp", - "request_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", - "action" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7722,18 +11715,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -7742,18 +11747,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -7762,18 +11780,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -7782,22 +11812,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", "actor_id", - "org_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issuer", - "business", "operation_type", "created_at", - "request_id", - "business_id", - "_document_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7805,19 +11845,31 @@ "description": "A user account was converted into an organization.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization", "fields": [ - "actor", + "@timestamp", "_document_id", - "request_id", - "operation_type", + "action", + "actor", "actor_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "@timestamp", - "created_at", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "owner", - "request_access_security_header" + "operation_type", + "created_at", + "owner" ], "docs_reference_titles": "Converting a user into an organization" }, @@ -7826,19 +11878,32 @@ "description": "A user was unblocked from an organization.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", "fields": [ - "oauth_application_id", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", - "@timestamp", - "request_id", - "created_at", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "blocked_user", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" }, @@ -7847,23 +11912,34 @@ "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "updated_allowed_types", "old_policy", - "updated_access_policy", - "programmatic_access_type", - "request_access_security_header" + "updated_access_policy" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" }, @@ -7872,20 +11948,32 @@ "description": "The default repository permission level for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", + "created_at", "permission", - "actor_id", - "old_permission", - "_document_id", - "programmatic_access_type" + "old_permission" ] }, { @@ -7894,20 +11982,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -7915,17 +12014,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -7935,20 +12047,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "business", - "@timestamp" + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -7957,19 +12080,32 @@ "description": "An organization's SAML provider settings were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "sso_url", - "actor_id", - "operation_type", "@timestamp", - "issuer", - "org", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "operation_type", + "issuer", + "created_at" ] }, { @@ -7977,18 +12113,30 @@ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", "fields": [ - "request_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "_document_id", - "org", - "action", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" }, @@ -7997,20 +12145,33 @@ "description": "A domain was approved for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "org_id", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" }, @@ -8019,16 +12180,31 @@ "description": "A domain was added to an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "created_at", + "@timestamp", "_document_id", - "domain_name", "action", - "request_id", + "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "domain_name", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8037,14 +12213,29 @@ "description": "A domain was removed from an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", "fields": [ - "action", - "domain_name", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "domain_name", "operation_type", "created_at" ], @@ -8055,16 +12246,31 @@ "description": "A domain was verified for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "operation_type", - "domain_name", "@timestamp", - "user_agent", - "request_id", - "actor", - "action", - "created_at", "_document_id", - "actor_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "domain_name", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8073,20 +12279,31 @@ "description": "An entire package was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" @@ -8096,23 +12313,34 @@ "description": "A package was published or republished to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "ecosystem", "version_count", "is_republished", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -8121,21 +12349,32 @@ "description": "A specific package version was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "version", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "ecosystem", "actor_is_bot" ], @@ -8146,21 +12385,34 @@ "description": "A specific package version was published or republished to a package.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "ecosystem", "package", "version", - "actor_id", - "user_agent", "is_republished", - "actor", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -8169,20 +12421,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -8191,17 +12457,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8212,20 +12493,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -8234,19 +12529,31 @@ "description": "A new passkey was added.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8254,19 +12561,31 @@ "description": "A new passkey was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8274,18 +12593,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8293,16 +12624,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8310,18 +12655,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8329,18 +12686,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8351,18 +12721,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8373,17 +12756,30 @@ "description": "Triggered when you create a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8393,19 +12789,31 @@ "description": "Triggered when you regenerate a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8413,12 +12821,29 @@ "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", "fields": [ - "user_programmatic_access_name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", "operation_type" ], @@ -8429,20 +12854,32 @@ "description": "Triggered when you delete a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "explanation", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8450,17 +12887,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8471,18 +12921,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8494,17 +12957,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8516,17 +12992,30 @@ "description": "A fine-grained personal access token was updated.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8537,15 +13026,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8555,17 +13059,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8575,15 +13090,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8593,17 +13123,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8613,17 +13154,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8633,17 +13185,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8653,17 +13216,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8673,17 +13247,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -8693,17 +13280,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8711,20 +13311,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -8734,17 +13345,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -8752,17 +13376,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "actor_id", - "operation_type", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -8770,18 +13407,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -8790,18 +13439,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -8810,19 +13471,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -8830,17 +13502,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -8852,22 +13537,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -8875,19 +13569,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -8895,17 +13600,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8913,18 +13631,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -8932,20 +13663,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8953,18 +13694,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -8973,18 +13726,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -8993,22 +13758,32 @@ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", "fields": [ - "repo", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "name", "created_at", - "_document_id", "operation_type", - "actor", - "repo_id", - "org", - "request_id", - "actor_id", - "oauth_application_id", - "@timestamp", - "programmatic_access_type" + "oauth_application_id" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" }, @@ -9017,29 +13792,34 @@ "description": "A protected branch allowance was given to a specific user, team or integration.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "authorized_actors", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -9047,24 +13827,32 @@ "description": "Branch protection was enabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "repo_id", - "user_id", "@timestamp", - "user_agent", - "repo", - "name", - "org_id", - "user", "_document_id", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", "created_at", "authorized_actor_names", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -9075,21 +13863,31 @@ "description": "Branch protection was disabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "repo", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", - "request_id", - "repo_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "name", + "operation_type", "created_at", - "_document_id", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -9100,22 +13898,32 @@ "description": "Enforcement of dismissing stale pull requests was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "dismiss_stale_reviews_on_push", - "org_id", - "action", - "created_at", - "request_id", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismiss_stale_reviews_on_push", + "created_at", "operation_type", - "actor", - "repo", - "org", - "name", - "programmatic_access_type" + "name" ] }, { @@ -9123,24 +13931,34 @@ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "authorized_actors_only", "authorized_actors", "created_at", - "user_agent", "name", - "_document_id", - "org_id", - "request_id", - "@timestamp", - "actor_id", - "org", - "action", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -9148,30 +13966,37 @@ "description": "A branch protection requirement was overridden by a repository administrator.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "actor", "reasons", - "@timestamp", "before", "after", - "actor_id", - "repo", "operation_type", - "user_agent", "branch", "overridden_codes", - "org", - "org_id", - "action", - "_document_id", - "request_id", "referrer", - "business", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "rule_suite_id" ] @@ -9181,28 +14006,36 @@ "description": "A branch update attempt was rejected.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "request_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "branch", "before", "overridden_codes", "after", - "action", "reasons", - "actor_id", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "actor_is_bot", "rule_suite_id" @@ -9213,23 +14046,32 @@ "description": "Branch protection was enforced for repository administrators.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "admin_enforced", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "name", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "action", "repo_id", - "org_id", - "_document_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "admin_enforced", + "operation_type", + "name", + "created_at" ] }, { @@ -9237,22 +14079,32 @@ "description": "Branch deletion was enabled or disabled for a protected branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "operation_type", - "request_id", - "repo", "@timestamp", - "org_id", - "org", - "action", - "allow_deletions_enforcement_level", "_document_id", - "created_at", - "actor_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_deletions_enforcement_level", + "created_at" ] }, { @@ -9260,23 +14112,32 @@ "description": "Force pushes were enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "actor_id", - "name", + "@timestamp", "_document_id", + "action", "actor", - "repo", - "operation_type", - "request_id", - "allow_force_pushes_enforcement_level", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_force_pushes_enforcement_level", + "created_at" ] }, { @@ -9284,24 +14145,33 @@ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "ignore_approvals_from_contributors", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -9310,22 +14180,32 @@ "description": "Required linear commit history was enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "operation_type", "actor", - "linear_history_requirement_enforcement_level", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "linear_history_requirement_enforcement_level", "name", - "org_id", - "repo_id", - "org", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ] }, { @@ -9333,24 +14213,33 @@ "description": "Fork syncing was enabled or disabled for a read-only branch", "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "lock_allows_fetch_and_merge", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -9359,27 +14248,34 @@ "description": "The enforcement of a branch lock was updated.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "name", "enforcement_level", "lock_branch_enforcement_level", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -9388,18 +14284,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9410,24 +14319,33 @@ "description": "A branch name pattern was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "old_name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "old_name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -9435,25 +14353,32 @@ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", "docs_reference_links": "N/A", "fields": [ - "name", - "org_id", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "@timestamp", + "business", "business_id", - "request_id", - "pull_request_reviews_enforcement_level", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "business", - "user_agent", - "created_at", "repo_id", - "operation_type", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "pull_request_reviews_enforcement_level", + "created_at", + "operation_type" ] }, { @@ -9461,22 +14386,32 @@ "description": "Enforcement of required code owner review was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "created_at", - "require_code_owner_review", - "operation_type", - "name", - "user_agent", - "action", "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "request_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "require_code_owner_review", + "operation_type", + "name" ] }, { @@ -9484,22 +14419,33 @@ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "require_last_push_approval", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" }, @@ -9508,22 +14454,32 @@ "description": "Enforcement of the required number of approvals before merging was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "required_approving_review_count", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "required_approving_review_count", "created_at", - "actor", "operation_type", - "user_agent", - "name", - "org_id", - "action", - "actor_id", - "_document_id", - "org", - "@timestamp", - "programmatic_access_type" + "name" ] }, { @@ -9531,25 +14487,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "user_agent", "@timestamp", "_document_id", - "name", - "repo", "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "business", - "actor_id", - "operation_type", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "required_status_checks_enforcement_level", - "org", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "required_status_checks_enforcement_level" ] }, { @@ -9557,22 +14520,32 @@ "description": "Enforcement of required commit signing was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "name", "@timestamp", - "created_at", "_document_id", - "request_id", - "repo_id", - "org", - "org_id", "action", "actor", "actor_id", - "signature_requirement_enforcement_level", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "programmatic_access_type" + "operation_type", + "name", + "created_at", + "signature_requirement_enforcement_level" ] }, { @@ -9580,22 +14553,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "_document_id", - "org", "@timestamp", - "created_at", - "repo_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "name", - "actor", - "repo", "operation_type", - "action", - "strict_required_status_checks_policy", - "programmatic_access_type" + "strict_required_status_checks_policy" ] }, { @@ -9603,23 +14586,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -9628,24 +14622,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -9654,20 +14659,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -9676,21 +14695,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -9700,22 +14732,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -9724,25 +14768,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -9751,23 +14805,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", "key", "fingerprint", - "actor_id", - "actor", "title", - "user_agent", - "user_id", - "request_id", - "read_only", - "token_scopes", - "programmatic_access_type" + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -9776,18 +14841,32 @@ "description": "A pull request was closed without being merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" @@ -9797,21 +14876,32 @@ "description": "A pull request was converted to a draft.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" }, @@ -9820,19 +14910,32 @@ "description": "A pull request was created.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -9843,23 +14946,35 @@ "description": "A review was requested on a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -9869,17 +14984,31 @@ "description": "A pull request was marked as in progress.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -9887,19 +15016,32 @@ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -9907,19 +15049,32 @@ "description": "A pull request was merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" @@ -9929,21 +15084,32 @@ "description": "A pull request was marked as ready for review.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" }, @@ -9952,27 +15118,34 @@ "description": "A pull request was rebased.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "pull_request_url", "pull_request_title", - "user", - "user_id", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9980,23 +15153,35 @@ "description": "A review request was removed from a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "created_at", + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" }, @@ -10005,18 +15190,32 @@ "description": "A pull request was reopened after previously being closed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -10024,19 +15223,31 @@ "description": "A review comment was added to a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "comment_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -10046,20 +15257,31 @@ "description": "A review comment on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", "@timestamp", "_document_id", - "repo", - "created_at", - "request_id", - "comment_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "comment_id", + "operation_type" ] }, { @@ -10067,18 +15289,31 @@ "description": "A review comment on a pull request was changed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "request_id", - "actor_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "_document_id", - "@timestamp", - "comment_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "comment_id" ] }, { @@ -10086,21 +15321,33 @@ "description": "A review on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ] }, { @@ -10108,20 +15355,33 @@ "description": "A review on a pull request was dismissed.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" }, @@ -10130,19 +15390,33 @@ "description": "A review on a pull request was submitted.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" @@ -10152,22 +15426,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -10176,21 +15460,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -10199,25 +15492,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -10226,23 +15526,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -10251,24 +15559,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -10277,23 +15592,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -10303,22 +15626,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -10327,19 +15659,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -10348,24 +15693,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -10374,24 +15729,32 @@ "description": "Autofix for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -10399,24 +15762,32 @@ "description": "Autofix for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -10424,23 +15795,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -10451,25 +15831,31 @@ "description": "Code scanning using the default setup was disabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -10478,26 +15864,34 @@ "description": "Code scanning using the default setup was enabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "query_suite", "threat_model", - "languages", - "request_access_security_header" + "languages" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -10506,25 +15900,34 @@ "description": "Code scanning using the default setup was updated for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "query_suite", "threat_model", "languages", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Configuring default setup for code scanning" @@ -10534,20 +15937,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "visibility", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -10555,17 +15969,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -10574,15 +16001,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -10593,16 +16033,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -10612,17 +16065,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -10632,19 +16098,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -10653,17 +16130,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -10672,26 +16162,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -10700,30 +16196,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -10733,20 +16234,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -10755,25 +16267,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -10782,23 +16302,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -10806,25 +16337,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -10834,17 +16374,30 @@ "description": "A repository was archived on disk.", "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories", "fields": [ - "actor_id", - "repo", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", - "repo_id", - "actor", "action", - "user_agent" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/archiving-a-github-repository/archiving-repositories" }, @@ -10853,23 +16406,32 @@ "description": "A source code archive of a repository was downloaded as a ZIP file.", "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "created_at", "operation_type", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" @@ -10879,20 +16441,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "visibility", - "repo_id", - "created_at", - "actor", - "action", - "@timestamp", "org_id", - "request_id", + "programmatic_access_type", "repo", - "_document_id" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "visibility", + "created_at" ] }, { @@ -10900,20 +16473,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "visibility", - "repo_id", - "request_id", - "action", - "_document_id", "@timestamp", - "actor_id", - "created_at", - "user", - "operation_type", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", "public_repo" ] }, @@ -10922,19 +16506,30 @@ "description": "The repository was unlocked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -10942,20 +16537,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "action", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "operation_type", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "visibility", - "actor", - "user_id" + "visibility" ] }, { @@ -10963,23 +16569,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -10987,21 +16603,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -11009,21 +16635,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -11031,22 +16667,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -11054,21 +16699,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", "visibility", - "actor", - "actor_id", - "user", - "operation_type", - "repo_id", - "action", - "repo", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -11076,20 +16731,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11097,22 +16763,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -11120,18 +16795,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -11139,22 +16828,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -11162,21 +16861,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -11184,18 +16893,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -11204,22 +16925,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -11228,24 +16958,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -11254,23 +16992,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -11278,26 +17026,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -11306,21 +17059,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -11329,25 +17091,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -11355,22 +17123,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -11379,20 +17157,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "visibility", - "operation_type", - "repo", + "@timestamp", "_document_id", - "user", - "user_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "@timestamp", - "request_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -11400,19 +17189,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -11420,17 +17220,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -11439,17 +17254,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -11458,7 +17288,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -11473,23 +17324,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -11499,20 +17359,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -11523,21 +17394,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -11546,22 +17428,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -11570,21 +17462,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -11593,22 +17496,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -11619,16 +17532,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -11637,22 +17561,31 @@ "description": "Temporary access was enabled for a repository.", "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing user-owned repositories in your enterprise" }, @@ -11662,22 +17595,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "repo_id", - "owner", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -11686,23 +17630,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -11712,19 +17666,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -11732,21 +17696,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -11755,24 +17729,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -11780,25 +17763,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -11807,24 +17797,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -11833,25 +17833,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -11860,22 +17868,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -11884,26 +17901,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -11911,31 +17936,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -11944,24 +17976,30 @@ "description": "Branch protections were disabled for the repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -11970,24 +18008,30 @@ "description": "Branch protections were enabled for this repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -11996,21 +18040,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -12018,21 +18072,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -12040,21 +18104,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -12062,20 +18137,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -12083,21 +18170,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -12105,19 +18203,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -12125,31 +18236,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -12158,19 +18277,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -12178,8 +18308,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -12188,23 +18317,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -12229,26 +18367,32 @@ "description": "Automatic partner validation checks have been disabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -12257,26 +18401,32 @@ "description": "Automatic partner validation checks have been enabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -12285,23 +18435,30 @@ "description": "A custom pattern was created for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12311,23 +18468,30 @@ "description": "A custom pattern was removed from secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12337,24 +18501,31 @@ "description": "A custom pattern was published for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12364,24 +18535,31 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -12390,24 +18568,31 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12417,23 +18602,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12443,23 +18635,31 @@ "description": "Secret scanning was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "public_repo", - "programmatic_access_type" + "public_repo" ], "docs_reference_titles": "About secret scanning" }, @@ -12468,22 +18668,30 @@ "description": "Secret scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -12491,24 +18699,32 @@ "description": "Secret scanning for non-provider patterns was disabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -12517,24 +18733,32 @@ "description": "Secret scanning for non-provider patterns was enabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -12543,19 +18767,31 @@ "description": "A role or team was added to the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -12564,24 +18800,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -12590,24 +18834,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -12616,19 +18868,31 @@ "description": "A role or team was removed from the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -12637,26 +18901,31 @@ "description": "Secret scanning push protection was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -12665,26 +18934,31 @@ "description": "Secret scanning push protection was enabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -12693,18 +18967,31 @@ "description": "Email notification restrictions for an organization or enterprise were disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -12713,19 +19000,31 @@ "description": "Email notification restrictions for an organization or enterprise were enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -12734,14 +19033,28 @@ "description": "GitHub detected a secret and created a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -12755,22 +19068,32 @@ "description": "A secret scanning alert was reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type_display_name" ] }, @@ -12779,28 +19102,37 @@ "description": "A secret scanning alert was resolved.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "resolution", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", + "resolution", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type", "secret_type_display_name", "publicly_leaked", - "multi_repo", - "request_access_security_header" + "multi_repo" ] }, { @@ -12808,25 +19140,32 @@ "description": "A secret scanning alert was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -12834,14 +19173,28 @@ "description": "A secret scanning alert was validated.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "previous_validity", @@ -12858,19 +19211,30 @@ "description": "Secret scanning was disabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -12879,19 +19243,30 @@ "description": "Secret scanning was enabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -12900,20 +19275,30 @@ "description": "Secret scanning was disabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -12922,19 +19307,30 @@ "description": "Secret scanning was enabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -12943,14 +19339,28 @@ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "push_protection_bypass_reason", @@ -12968,25 +19378,33 @@ "description": "A request to bypass secret scanning push protection was approved by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -12995,25 +19413,33 @@ "description": "A request to bypass secret scanning push protection was denied by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", - "request_access_security_header", "request_reviewer_comment" ], "docs_reference_titles": "About push protection" @@ -13023,25 +19449,33 @@ "description": "A user requested to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" }, @@ -13050,18 +19484,30 @@ "description": "A security key was registered for an account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "created_at", - "user_id", - "action", - "operation_type", - "request_id", "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -13069,18 +19515,30 @@ "description": "A security key was removed from an account.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "operation_type", - "_document_id", - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13088,16 +19546,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -13107,18 +19578,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -13127,16 +19611,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -13147,15 +19644,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -13165,15 +19675,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -13182,17 +19707,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -13201,17 +19739,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -13220,16 +19772,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -13239,14 +19804,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -13256,17 +19836,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -13275,17 +19868,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -13294,18 +19900,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -13314,15 +19933,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -13332,16 +19965,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13349,15 +19995,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -13368,16 +20027,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -13387,17 +20059,30 @@ "description": "Triggered when you send an email update to your sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", "fields": [ - "request_id", - "actor", - "action", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" }, @@ -13406,17 +20091,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -13427,17 +20125,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -13448,18 +20159,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -13469,16 +20191,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -13488,17 +20223,30 @@ "description": "You join the waitlist to join GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "actor_id", - "action", "operation_type", - "created_at", - "user", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -13507,16 +20255,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -13528,17 +20289,30 @@ "fields": [ "@timestamp", "_document_id", - "fingerprint", - "operation_type", - "openssh_public_key", - "org_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "request_id" + "fingerprint", + "operation_type", + "openssh_public_key", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -13547,19 +20321,32 @@ "description": "An SSH certificate authority for an organization or enterprise was deleted.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "created_at", + "@timestamp", "_document_id", - "fingerprint", - "operation_type", + "action", "actor", - "org_id", - "openssh_public_key", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", - "request_id" + "created_at", + "fingerprint", + "operation_type", + "openssh_public_key" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -13568,21 +20355,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "user", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "request_id", - "org", - "org_id", - "created_at", - "actor", "action", - "user_id", + "actor", + "actor_id", "business", "business_id", - "@timestamp", - "actor_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -13591,19 +20387,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "actor_id", - "user_id", - "org", - "operation_type", - "request_id", "@timestamp", "_document_id", - "actor", - "user", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -13612,20 +20419,34 @@ "description": "The verification code expiry time for an organization or enterprise domain was set.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "token_expires_at", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -13633,18 +20454,33 @@ "description": "An organization or enterprise domain was unverified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ] }, { @@ -13652,16 +20488,31 @@ "description": "An organization or enterprise domain was verified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "domain_name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -13669,15 +20520,30 @@ "description": "Triggered when you accept a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -13686,15 +20552,30 @@ "description": "Triggered when you cancel a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -13703,15 +20584,30 @@ "description": "Triggered when you create a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -13720,15 +20616,30 @@ "description": "Triggered when you decline a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -13737,15 +20648,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -13753,15 +20679,30 @@ "description": "Triggered when you revoke a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -13770,21 +20711,31 @@ "description": "A member of an organization was added to a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", "fields": [ - "user_agent", - "request_id", - "org_id", - "user_id", - "team", - "user", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type", - "_document_id", - "org", - "action", - "actor", - "programmatic_access_type", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" @@ -13794,22 +20745,31 @@ "description": "A team was given access and permissions to a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "team", - "action", - "operation_type", - "request_id", - "created_at", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "actor_id", - "_document_id", "repo_id", - "user_agent", - "org_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -13818,20 +20778,31 @@ "description": "A child team was created or a child team's parent was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", "fields": [ - "org", "@timestamp", - "created_at", "_document_id", - "team", "action", - "operation_type", "actor", - "request_id", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", + "operation_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" }, @@ -13840,18 +20811,31 @@ "description": "A team's privacy level was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", "fields": [ - "user_agent", - "request_id", - "org", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", "created_at", "operation_type", - "actor_id", - "org_id", - "@timestamp", - "actor", - "_document_id", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" @@ -13861,21 +20845,32 @@ "description": "A new team is created.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "oauth_application_id", + "operation_type", "team", - "org", - "actor", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "team_type" ] }, @@ -13884,21 +20879,31 @@ "description": "A user was demoted from a team maintainer to a team member.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" }, @@ -13907,19 +20912,31 @@ "description": "A team was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "team", "org_id", - "actor_id", - "actor", - "action", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", "operation_type", - "_document_id", - "programmatic_access_type", "team_type" ] }, @@ -13928,19 +20945,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "business_id", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", "actor_id", - "user", "business", - "action", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13948,19 +20976,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "operation_type", - "request_id", "actor", - "org", - "created_at", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", - "_document_id" + "operation_type", + "created_at" ] }, { @@ -13968,18 +21007,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", "@timestamp", - "action", "_document_id", - "user_agent", - "user_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business", + "user_id", + "user_agent", "operation_type", - "actor", "created_at" ] }, @@ -13988,22 +21038,31 @@ "description": "A user was promoted from a team member to a team maintainer.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" }, @@ -14012,22 +21071,31 @@ "description": "An organization member was removed from a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", "fields": [ - "request_id", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "team", - "user_id", - "actor", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", + "user_id", "user_agent", - "_document_id", - "token_scopes", - "programmatic_access_type", + "operation_type", + "created_at", + "team", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" @@ -14037,21 +21105,31 @@ "description": "A repository was removed from a team's control.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "org_id", - "repo", - "repo_id", - "action", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "created_at", "team", - "org", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -14059,21 +21137,32 @@ "description": "A team's name was changed.", "docs_reference_links": "N/A", "fields": [ - "name", - "user_agent", - "created_at", - "team", - "operation_type", - "actor_id", - "org", + "@timestamp", + "_document_id", "action", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "_document_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "team", + "operation_type", "team_type" ] }, @@ -14082,17 +21171,30 @@ "description": "Team synchronization with a tenant was disabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "request_id", - "org_id", "actor_id", - "operation_type", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -14101,19 +21203,30 @@ "description": "Team synchronization with a tenant was enabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ - "org_id", - "business_id", - "actor", - "created_at", - "user_agent", "@timestamp", - "operation_type", - "business", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -14122,28 +21235,37 @@ "description": "A team's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "team", - "org_id", "@timestamp", - "org", "_document_id", - "old_permission", - "request_id", - "repo", "action", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "old_permission", "operation_type", "created_at", - "user_agent", "permission", "new_repo_permission", "new_repo_base_role", "old_repo_permission", - "old_repo_base_role", - "token_scopes", - "programmatic_access_type" + "old_repo_base_role" ] }, { @@ -14151,17 +21273,30 @@ "description": "A new trusted device was added.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14169,17 +21304,30 @@ "description": "A trusted device was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14187,14 +21335,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "action", - "request_id", - "user_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -14203,15 +21366,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "created_at", - "user_id", - "operation_type", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action" + "created_at", + "operation_type" ] }, { @@ -14219,13 +21397,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "created_at", - "user_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14233,17 +21428,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "operation_type", - "action", - "_document_id" + "created_at", + "operation_type" ] }, { @@ -14251,17 +21459,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user", - "created_at", - "request_id", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -14269,16 +21490,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14286,15 +21521,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_id", - "action", "@timestamp", - "created_at", - "user_agent", - "user", "_document_id", - "request_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14302,18 +21552,30 @@ "description": "A secondary authentication factor was added to a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -14322,18 +21584,30 @@ "description": "Two-factor authentication was disabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", "fields": [ - "actor", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor_id", + "user_agent", "created_at", - "operation_type", - "request_id", - "@timestamp", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Disabling two-factor authentication for your personal account" }, @@ -14342,18 +21616,30 @@ "description": "Two-factor authentication was enabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ - "actor", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Configuring two-factor authentication" }, @@ -14362,15 +21648,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "@timestamp", - "request_id", - "_document_id", - "user_agent" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14378,16 +21679,29 @@ "description": "Two factor recovery codes were regenerated for a user account.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", + "operation_type", "created_at" ] }, @@ -14396,18 +21710,30 @@ "description": "A secondary authentication factor was removed from a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -14416,15 +21742,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "created_at", - "_document_id", - "action", - "@timestamp" + "operation_type", + "created_at" ] }, { @@ -14433,16 +21774,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "operation_type", "user_agent", - "action", - "request_id", - "actor", - "actor_id" + "created_at", + "operation_type" ] }, { @@ -14450,19 +21804,31 @@ "description": "An email address was added to a user account.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", "operation_type", - "_document_id", - "actor_id", - "actor", "email", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding an email address to your GitHub account" }, @@ -14471,18 +21837,30 @@ "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "created_at", - "user", "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -14490,15 +21868,28 @@ "description": "Audit log entries were exported.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "action", - "request_id", - "actor", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", "created_at" ] @@ -14508,20 +21899,31 @@ "description": "A user was blocked by another user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_id", - "_document_id", "actor_id", - "@timestamp", - "user_agent", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -14529,18 +21931,30 @@ "description": "A user changed their password.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "actor_id", - "operation_type", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "created_at", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14548,18 +21962,30 @@ "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -14568,17 +21994,30 @@ "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -14587,16 +22026,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "user_agent", - "created_at", - "user", "action", - "operation_type", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14604,16 +22057,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "_document_id", "@timestamp", - "created_at", - "user_agent", - "operation_type", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14621,16 +22088,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "created_at", - "_document_id", - "user_agent", - "user_id", "@timestamp", - "user", + "_document_id", "action", - "request_access_security_header" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14638,19 +22119,31 @@ "description": "A new user account was created.", "docs_reference_links": "N/A", "fields": [ - "email", - "user_id", - "operation_type", "@timestamp", - "request_id", - "user", - "created_at", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "action", - "programmatic_access_type" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "email", + "operation_type", + "created_at" ] }, { @@ -14658,21 +22151,33 @@ "description": "A user secret for Codespaces was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -14680,20 +22185,31 @@ "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "user_agent", + "@timestamp", "_document_id", - "operation_type", - "oauth_application_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "@timestamp", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -14701,18 +22217,30 @@ "description": "A user account was destroyed by an asynchronous job.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "request_id", - "user_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14721,19 +22249,30 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "oauth_application_id", + "_document_id", "action", - "user", - "created_at", - "user_agent", - "request_id", "actor", "actor_id", - "operation_type", - "_document_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", + "operation_type" ] }, { @@ -14741,18 +22280,30 @@ "description": "A user deleted his or her account, triggering user.async_delete.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "_document_id", - "created_at", - "user_agent", "user_id", - "operation_type", - "actor_id", - "action", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14760,18 +22311,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "user_agent", "user_id", - "actor_id", - "action", - "operation_type", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14779,18 +22342,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "operation_type", - "created_at", - "_document_id", - "@timestamp", - "user", - "actor_id", - "action", - "request_access_security_header" + "created_at" ] }, { @@ -14799,17 +22374,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user", "_document_id", "action", - "operation_type", - "user_agent", - "created_at", - "request_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14817,17 +22404,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14835,17 +22435,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14853,17 +22466,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14871,21 +22497,31 @@ "description": "An enterprise managed user claimed an email address.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14893,21 +22529,31 @@ "description": "N/A", "docs_reference_links": "An enterprise managed user unclaimed an email address.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." }, @@ -14916,17 +22562,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14934,17 +22593,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14952,17 +22624,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14970,18 +22655,30 @@ "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "action", - "operation_type", - "request_id", - "created_at", - "_document_id", "@timestamp", - "user", - "org_id", + "_document_id", + "action", "actor", "actor_id", - "user_agent" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14989,16 +22686,29 @@ "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", "user_agent", + "operation_type", "created_at" ] }, @@ -15007,17 +22717,31 @@ "description": "A user requested a password reset.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", "fields": [ - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "email", - "created_at", - "user_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" }, @@ -15026,17 +22750,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "created_at", - "user_agent", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor", - "operation_type", - "request_id" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -15044,18 +22781,30 @@ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -15064,19 +22813,31 @@ "description": "A user signed in.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "actor_id", "@timestamp", - "user", - "action", - "operation_type", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "actor", - "passkey_nickname", - "request_access_security_header" + "passkey_nickname" ] }, { @@ -15084,18 +22845,30 @@ "description": "A user signed out.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -15103,38 +22876,61 @@ "description": "A comment made by a user was minimized.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", - "actor_id", "@timestamp", - "created_at", - "operation_type", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "user.new_device_used", + "description": "A user signed in from a new device.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" - ] - }, - { - "action": "user.new_device_used", - "description": "A user signed in from a new device.", - "docs_reference_links": "N/A", - "fields": [ "user", "user_id", - "actor", - "operation_type", - "created_at", "user_agent", - "actor_id", - "action", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -15142,14 +22938,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", "_document_id", "action", - "@timestamp", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15157,21 +22969,31 @@ "description": "An ordinary user account was promoted to a site administrator.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", + "user_id", "user_agent", + "created_at", "oauth_application_id", - "request_id", - "operation_type", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -15179,16 +23001,29 @@ "description": "A user's account was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user", - "action", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "actor", "operation_type" ] }, @@ -15197,20 +23032,31 @@ "description": "An email address was removed from a user account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "actor", - "actor_id", "created_at", - "email", - "token_scopes", - "programmatic_access_type" + "email" ] }, { @@ -15218,20 +23064,32 @@ "description": "A user secret for Codespaces was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "key", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "key", + "integration", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -15239,17 +23097,30 @@ "description": "A user account was no longer flagged as a large scale contributor.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15257,20 +23128,31 @@ "description": "A username was changed.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "request_id", - "actor_id", - "old_login", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "operation_type", "user_agent", - "token_scopes", - "programmatic_access_type" + "old_login", + "created_at", + "operation_type" ] }, { @@ -15278,17 +23160,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "user_agent", - "request_id", - "action", "@timestamp", - "created_at", - "org_id", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -15297,18 +23191,30 @@ "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "action", "created_at", - "actor", - "operation_type", - "actor_id", - "user_id", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam" }, @@ -15317,18 +23223,30 @@ "description": "A user reset their account password.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "@timestamp", - "_document_id", - "actor", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -15336,16 +23254,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_id", - "action", "@timestamp", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -15356,16 +23287,28 @@ "fields": [ "@timestamp", "_document_id", - "request_id", - "user_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor_id", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -15374,18 +23317,30 @@ "description": "A user signed in from an unrecognized device.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "created_at", - "actor", - "actor_id", - "@timestamp", - "request_access_security_header" + "created_at" ] }, { @@ -15393,18 +23348,30 @@ "description": "A user signed in from an unrecognized device and location.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "created_at", - "_document_id", - "request_id", - "action", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -15412,18 +23379,30 @@ "description": "A user signed in from an unrecognized location.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "action", - "operation_type", - "user_agent", - "user", + "@timestamp", "_document_id", + "action", "actor", - "created_at", "actor_id", - "@timestamp", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15431,22 +23410,33 @@ "description": "Triggered when you clear the status on your profile.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "message", - "user", - "actor_id", "created_at", - "request_id", "limited_availability", - "action", "emoji", - "operation_type", - "user_agent", - "@timestamp", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -15454,23 +23444,33 @@ "description": "Triggered when you set or change the status on your profile.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", "fields": [ - "limited_availability", - "user", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "message", - "user_id", - "created_at", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "limited_availability", + "message", + "created_at", "emoji", - "org", - "actor", - "operation_type", - "token_scopes", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Personalize your profile" }, @@ -15479,21 +23479,31 @@ "description": "A user account was suspended.", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", - "operation_type", - "actor_id", - "user", - "user_agent", - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", - "user_id", + "_document_id", "action", - "token_scopes", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -15501,18 +23511,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "actor_id", - "@timestamp", - "operation_type", - "_document_id", - "user_agent", - "actor", - "action", "user_id", - "created_at", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15520,18 +23542,30 @@ "description": "A 2FA challenge issued for a user account failed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "_document_id", - "user_agent", - "user", - "actor_id", - "actor", - "user_id", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15541,16 +23575,28 @@ "fields": [ "@timestamp", "_document_id", - "user_id", - "operation_type", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "actor", + "user_id", "user_agent", - "request_id", - "action", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -15558,18 +23604,30 @@ "description": "A user used their 2FA recovery codes.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "user_agent", - "request_id", - "user", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "created_at", - "@timestamp", - "_document_id", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15577,18 +23635,30 @@ "description": "A user downloaded 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -15596,17 +23666,30 @@ "description": "A user printed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", - "user_agent", - "request_id", - "user_id", - "created_at", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15614,18 +23697,30 @@ "description": "A user viewed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", "created_at", - "user", - "operation_type", - "@timestamp", - "request_id", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -15633,17 +23728,30 @@ "description": "A user was prompted for a two-factor authentication code.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", "fields": [ - "user", - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "actor" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" }, @@ -15652,19 +23760,31 @@ "description": "A user was unblocked by another user.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "actor", - "@timestamp", - "user_agent", - "user_id", - "user", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -15673,15 +23793,28 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user_agent", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "request_id", - "actor", - "action", "created_at" ] }, @@ -15690,21 +23823,31 @@ "description": "A user account was unsuspended.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", - "user", "action", - "user_agent", "actor", - "oauth_application_id", - "operation_type", "actor_id", - "created_at", - "@timestamp", - "user_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -15712,21 +23855,33 @@ "description": "A user secret for Codespaces was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -15734,18 +23889,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -15753,27 +23920,33 @@ "description": "A workflow job was approved.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", - "repo", - "repo_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -15782,23 +23955,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -15806,10 +23989,28 @@ "description": "A workflow run was cancelled.", "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -15820,20 +24021,9 @@ "run_number", "cancelled_at", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Canceling a workflow run" }, @@ -15842,23 +24032,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15868,10 +24066,28 @@ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -15883,19 +24099,9 @@ "conclusion", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -15906,10 +24112,28 @@ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -15918,21 +24142,10 @@ "head_branch", "head_sha", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "public_repo", - "programmatic_access_type", "actor_is_bot", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "Understanding GitHub Actions" @@ -15942,23 +24155,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -15967,22 +24192,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15990,21 +24226,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -16012,25 +24259,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16038,23 +24293,36 @@ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", "fields": [ - "repo_id", - "repo", - "org_id", - "org", - "business_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "job_name", "runner_labels", "is_hosted_runner", "environment_name", "secrets_passed", - "action", - "_document_id", "operation_type", "created_at", - "@timestamp", "runner_owner_type", "job_workflow_ref", "calling_workflow_refs", @@ -16068,24 +24336,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -16094,10 +24371,28 @@ "description": "A workflow run was re-run.", "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -16107,21 +24402,11 @@ "head_sha", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", "rerun_type", "check_run_id", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "Re-running workflows and jobs" @@ -16131,25 +24416,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.14/organization.json b/src/audit-logs/data/ghes-3.14/organization.json index 33ee317030bb..489dcc450f7f 100644 --- a/src/audit-logs/data/ghes-3.14/organization.json +++ b/src/audit-logs/data/ghes-3.14/organization.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,29 +67,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -72,21 +103,32 @@ "description": "Credit was accepted for a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Editing a repository security advisory" }, @@ -95,21 +137,32 @@ "description": "Someone was added to the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -117,21 +170,32 @@ "description": "Credit was declined for a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -140,21 +204,32 @@ "description": "Someone was removed from the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -163,18 +238,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -182,17 +269,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -203,39 +301,62 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" - }, + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -244,19 +365,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -265,18 +398,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -284,18 +430,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -303,20 +461,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -325,20 +494,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -349,17 +529,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -367,14 +559,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -384,28 +591,34 @@ "description": "An attempt to create a codespace from a prebuild was made.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "owner", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "user_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_id", + "user_agent", + "name", + "owner", + "pull_request_id", "created_at", "operation_type", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -413,17 +626,30 @@ "description": "Enterprise setting for Codespaces ownership was updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enablement", "organization_names", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -434,25 +660,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -463,22 +698,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -490,22 +736,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -514,15 +771,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -533,15 +805,28 @@ "description": "Policies were applied to codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -551,20 +836,30 @@ "description": "Policies were removed from codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -572,19 +867,30 @@ "description": "Policies were updated for codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -592,17 +898,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -612,27 +931,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", "org", - "owner", - "pull_request_id", - "machine_type", - "user_id", - "user", - "devcontainer_path", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "owner", + "pull_request_id", + "machine_type", + "devcontainer_path", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -640,19 +968,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -660,18 +1001,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -680,20 +1033,30 @@ "description": "A commit comment was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "repo", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "created_at", - "@timestamp", - "operation_type", + "programmatic_access_type", + "repo", "repo_id", - "actor_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "programmatic_access_type" + "created_at", + "operation_type" ] }, { @@ -701,21 +1064,30 @@ "description": "A commit comment was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "repo_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_id", - "action", - "@timestamp", - "repo", "org_id", - "actor_id", - "created_at", - "user_agent", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -723,21 +1095,33 @@ "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "reason", "plan", - "org_id", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -745,13 +1129,28 @@ "description": "Copilot feature settings were changed at the organization level.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -761,23 +1160,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -785,16 +1191,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -803,40 +1223,59 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "request_access_security_header" - ] - }, - { - "action": "copilot.cfb_seat_assignment_reused", - "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", - "docs_reference_links": "N/A", - "fields": [ - "actor", - "actor_id", - "user_agent", - "request_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "copilot.cfb_seat_assignment_reused", + "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -846,20 +1285,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -867,19 +1316,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -887,21 +1348,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -909,21 +1379,33 @@ "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_value", "new_value", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -931,21 +1413,32 @@ "description": "The excluded paths for GitHub Copilot were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "excluded_paths", "owner_type", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -953,21 +1446,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -975,21 +1478,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -997,39 +1510,62 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", - "org", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "actor_is_bot", - "request_access_security_header" - ] - }, - { - "action": "copilot.plan_changed", - "description": "The plan for GitHub Copilot was updated.", - "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot", - "fields": [ - "actor", - "actor_id", - "user_agent", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, + { + "action": "copilot.plan_changed", + "description": "The plan for GitHub Copilot was updated.", + "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_plan", "plan", - "business_id", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1041,21 +1577,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1065,19 +1610,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1087,21 +1641,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1111,18 +1674,31 @@ "description": "A new custom property definition was created.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -1135,18 +1711,31 @@ "description": "A custom property definition was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -1160,14 +1749,29 @@ "description": "A custom property definition was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "value_type", @@ -1180,8 +1784,7 @@ "old_default_value", "old_value_type", "old_values_editable_by", - "values_editable_by", - "request_access_security_header" + "values_editable_by" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1190,27 +1793,35 @@ "description": "A repository's custom property value was manually set for the first time.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1219,19 +1830,31 @@ "description": "A repository's custom property value was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repository", - "repository_id", - "public_repo", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "public_repo", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1240,16 +1863,29 @@ "description": "A repository's custom property value was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "definition_id" @@ -1261,19 +1897,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1282,19 +1929,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1303,19 +1961,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1324,19 +1993,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1345,17 +2025,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1363,19 +2056,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1384,19 +2088,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1404,40 +2119,62 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependabot_security_updates_new_repos.enable", - "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + }, + { + "action": "dependabot_security_updates_new_repos.enable", + "description": "Dependabot security updates were enabled for all new repositories.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1445,19 +2182,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1466,19 +2214,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1486,19 +2245,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1507,20 +2277,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1528,21 +2308,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", - "repo_id", - "request_id", + "@timestamp", + "_document_id", "action", "actor", - "org_id", - "_document_id", "actor_id", - "operation_type", - "@timestamp", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -1550,20 +2339,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo_id", "@timestamp", - "actor", - "user_agent", - "request_id", - "org", "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "repo", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -1571,22 +2370,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "user_agent", - "actor_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "title", - "_document_id", - "created_at", - "repo", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -1594,21 +2402,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "team", - "created_at", - "user_id", "@timestamp", - "number", - "org", - "title", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", "user_agent", - "operation_type", - "_document_id" + "team", + "created_at", + "number", + "title", + "operation_type" ] }, { @@ -1616,18 +2436,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user_id", - "actor", "number", - "user", - "created_at", - "request_id", - "_document_id" + "created_at" ] }, { @@ -1635,18 +2468,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "action", - "_document_id", - "request_id", - "org", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org_id", "user_agent", - "actor", + "operation_type", "number", "team", "created_at" @@ -1657,21 +2501,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "_document_id", - "title", - "user", - "user_agent", - "org", - "operation_type", - "actor_id", "@timestamp", - "actor", - "team", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", + "title", + "operation_type", + "team", "number" ] }, @@ -1680,17 +2535,31 @@ "description": "A global announcement banner was created for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -1701,16 +2570,30 @@ "description": "A global announcement banner was removed from the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -1721,18 +2604,32 @@ "description": "A global announcement banner was updated for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", - "message", - "old_message", - "action", - "_document_id", - "@timestamp", + "message", + "old_message", "created_at", "operation_type" ], @@ -1743,17 +2640,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was created.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", - "operation_type", "@timestamp", "_document_id", - "org_id", "action", - "request_id", - "org", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -1762,17 +2672,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was deleted.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", + "@timestamp", "_document_id", "action", - "@timestamp", - "actor_id", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -1781,22 +2704,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1805,22 +2737,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1828,28 +2770,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1858,27 +2806,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -1887,25 +2843,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1914,26 +2878,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1942,21 +2913,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1965,22 +2948,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1989,25 +2982,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2016,22 +3018,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -2040,21 +3054,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -2065,19 +3089,30 @@ "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2086,20 +3121,30 @@ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2108,19 +3153,30 @@ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2129,23 +3185,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2153,18 +3218,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -2175,20 +3250,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2198,25 +3283,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -2224,25 +3319,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -2250,26 +3354,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -2278,25 +3391,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -2304,26 +3426,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -2331,21 +3462,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -2354,19 +3496,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -2374,21 +3529,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -2397,19 +3563,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -2420,20 +3600,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2443,24 +3635,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2471,23 +3674,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2498,21 +3713,33 @@ "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", "operation_type", - "@timestamp", "integration", - "action", - "user_agent", "reason", - "_document_id", - "org", - "org_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -2523,20 +3750,32 @@ "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ "@timestamp", - "actor_id", - "org", "_document_id", - "requester", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "requester", "created_at", "url", - "org_id", - "request_id", "operation_type", - "actor", "integration", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -2546,20 +3785,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2569,19 +3821,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -2590,20 +3856,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -2613,20 +3892,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -2635,20 +3927,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -2657,20 +3962,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -2678,19 +3995,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2699,19 +4029,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2720,17 +4063,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2743,21 +4099,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -2771,17 +4140,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2793,19 +4175,30 @@ "description": "An IP allow list was disabled.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "actor", - "request_id", - "org", - "user_agent", + "@timestamp", "_document_id", - "user_id", + "action", + "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "@timestamp", - "user" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2813,19 +4206,30 @@ "description": "An IP allow list was disabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2833,20 +4237,29 @@ "description": "An IP allow list was enabled.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "user_id", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "business_id", - "_document_id", - "action", - "@timestamp", + "user_id", "user_agent", - "actor_id", "operation_type", - "org", "created_at" ] }, @@ -2855,19 +4268,30 @@ "description": "An IP allow list was enabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2875,24 +4299,32 @@ "description": "An IP address was added to an IP allow list.", "docs_reference_links": "N/A", "fields": [ - "active", - "org", - "ip_allow_list_entry", "@timestamp", "_document_id", - "operation_type", - "created_at", - "user_agent", "action", - "request_id", + "actor", "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "business", - "actor", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", + "ip_allow_list_entry", + "operation_type", + "created_at" ] }, { @@ -2900,24 +4332,32 @@ "description": "An IP address was deleted from an IP allow list.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "ip_allow_list_entry", - "org", - "operation_type", - "created_at", - "active", "action", - "@timestamp", + "actor", + "actor_id", "business", "business_id", - "user_agent", + "hashed_token", + "org", "org_id", - "actor", - "actor_id", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ip_allow_list_entry", + "operation_type", + "created_at", + "active" ] }, { @@ -2925,19 +4365,32 @@ "description": "An IP address or its description was changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "actor_id", "ip_allow_list_entry", - "active", - "org_id", - "@timestamp" + "active" ] }, { @@ -2945,22 +4398,31 @@ "description": "A comment on an issue was deleted from the repository.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "org", - "repo", - "actor_id", "@timestamp", - "created_at", "_document_id", "action", - "operation_type", - "user_agent", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "oauth_application_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -2968,24 +4430,30 @@ "description": "A comment on an issue was pinned to a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -2996,19 +4464,29 @@ "description": "A comment on an issue was unpinned from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3019,22 +4497,31 @@ "description": "A comment on an issue (other than the initial one) changed.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", - "action", - "repo_id", - "org_id", - "created_at", - "operation_type", "@timestamp", - "user_agent", - "request_id", "_document_id", - "actor_id", + "action", "actor", - "oauth_application_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -3042,21 +4529,31 @@ "description": "An issue was deleted from the repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", "fields": [ - "user", - "actor_id", - "created_at", - "title", "@timestamp", "_document_id", - "request_id", - "actor", - "user_id", "action", - "operation_type", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "title", + "operation_type" ], "docs_reference_titles": "Deleting an issue" }, @@ -3065,23 +4562,33 @@ "description": "An issue was pinned to a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ + "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", "action", "actor", - "operation_type", - "owner_type", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "number", - "repo", - "event", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type", + "owner_type", + "number", + "event" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -3090,22 +4597,32 @@ "description": "An issue was transferred to another repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "owner_type", - "actor_id", "number", - "repo", "operation_type", - "_document_id", - "repo_id", - "action", - "request_id", - "created_at", - "actor", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Transferring an issue to another repository" }, @@ -3114,24 +4631,33 @@ "description": "An issue was unpinned from a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ - "event", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", - "action", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "operation_type", - "_document_id", - "number", - "owner_type", - "@timestamp", + "token_id", + "token_scopes", "user", "user_id", - "token_scopes", - "request_access_security_header" + "user_agent", + "event", + "created_at", + "operation_type", + "number", + "owner_type" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -3140,19 +4666,30 @@ "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user_agent", - "action", "@timestamp", - "operation_type", - "request_id", - "actor_id", - "user_id", - "created_at", "_document_id", + "action", "actor", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "org_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3161,18 +4698,29 @@ "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -3182,19 +4730,30 @@ "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user", - "request_id", - "actor", - "business_id", - "action", - "operation_type", - "user_agent", - "created_at", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor_id" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3203,18 +4762,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3222,21 +4793,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -3244,21 +4828,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -3266,22 +4863,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -3289,19 +4899,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -3311,22 +4934,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -3334,22 +4970,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -3357,20 +5006,30 @@ "description": "The ability for members to publish GitHub Pages sites was disabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3379,20 +5038,30 @@ "description": "The ability for members to publish GitHub Pages sites was enabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3401,21 +5070,30 @@ "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3424,22 +5102,30 @@ "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3448,21 +5134,30 @@ "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3471,22 +5166,30 @@ "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3495,19 +5198,30 @@ "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "operation_type", "user_agent", - "actor", - "actor_id", - "business_id", - "@timestamp", - "created_at", - "action" + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3516,18 +5230,29 @@ "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "request_id", - "org", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "actor", "operation_type", - "org_id", - "action", - "@timestamp", "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -3537,21 +5262,30 @@ "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "action", - "org_id", - "user_id", - "business", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business_id", + "user_id", + "user_agent", "created_at", - "actor", - "org", - "operation_type", - "user_agent" + "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3562,16 +5296,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -3580,21 +5325,30 @@ "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "created_at", - "user_id", "business_id", - "user", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "org_id", - "@timestamp" + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -3603,19 +5357,30 @@ "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ - "request_id", - "created_at", - "_document_id", - "user_agent", - "user", - "user_id", - "business", - "business_id", - "operation_type", "@timestamp", + "_document_id", "action", "actor", - "actor_id" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -3624,19 +5389,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3644,21 +5421,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3668,16 +5454,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3687,18 +5486,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3708,14 +5520,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -3723,19 +5551,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -3743,18 +5582,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3762,23 +5613,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -3786,16 +5645,30 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "org_id", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3803,24 +5676,32 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "org_id", - "request_id", - "oauth_application_id", - "repo_id", - "operation_type", "@timestamp", - "user_agent", - "created_at", - "org", - "action", "_document_id", - "repo", + "action", "actor", - "token_scopes", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at", + "actor_is_bot" ] }, { @@ -3828,15 +5709,28 @@ "description": "A network configuration for a hosted compute service was created.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -3854,15 +5748,28 @@ "description": "A network configuration for a hosted compute service was deleted.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -3875,15 +5782,28 @@ "description": "A network configuration for a hosted compute service was updated.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -3900,20 +5820,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3922,20 +5854,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3944,20 +5888,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3966,20 +5922,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3988,19 +5956,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4009,20 +5990,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4031,20 +6024,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "action", - "_document_id", - "actor", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4053,19 +6058,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4074,17 +6092,28 @@ "description": "An invitation sent to an organization to join an enterprise was accepted.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4095,20 +6124,30 @@ "description": "A billing manager was added to an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "org", - "user_id", "action", - "created_at", - "org_id", - "user", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" }, @@ -4117,21 +6156,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -4140,24 +6189,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4165,21 +6224,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -4187,20 +6256,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -4208,22 +6287,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -4231,20 +6318,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -4252,22 +6349,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -4275,19 +6380,30 @@ "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -4296,19 +6412,30 @@ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -4318,15 +6445,28 @@ "description": "Third-party application access for outside collaborators was disabled for the organization.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4337,15 +6477,28 @@ "description": "Third-party application access for outside collaborators was enabled for the organization.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4356,15 +6509,28 @@ "description": "The organization was archived.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4374,17 +6540,30 @@ "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", "fields": [ - "org_id", - "operation_type", "@timestamp", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" }, @@ -4393,21 +6572,32 @@ "description": "An export of the organization's Git events was created.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "start", "end", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" }, @@ -4416,16 +6606,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_agent", - "action", "@timestamp", - "actor_id", - "org_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -4434,18 +6637,31 @@ "description": "An organization owner blocked a user from accessing the organization's repositories.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org_id", "created_at", - "_document_id", "blocked_user", - "action", - "operation_type", - "actor_id", - "org", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" }, @@ -4454,19 +6670,30 @@ "description": "An invitation for an organization to join an enterprise was revoked", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "initiated_from" ], "docs_reference_titles": "Adding organizations to your enterprise" @@ -4476,22 +6703,33 @@ "description": "An invitation sent to a user to join an organization was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "email", - "@timestamp", - "actor", - "action", "operation_type", - "user_agent", - "org", "invitation_id", - "_document_id", "created_at", - "invitee_email", - "token_scopes", - "programmatic_access_type" + "invitee_email" ] }, { @@ -4499,19 +6737,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -4519,23 +6768,31 @@ "description": "Autofix for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4543,21 +6800,31 @@ "description": "Autofix for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4565,21 +6832,30 @@ "description": "Code scanning using the default setup was disabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -4588,21 +6864,30 @@ "description": "Code scanning using the default setup was enabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -4611,20 +6896,31 @@ "description": "Access to use Codespaces on internal and private repositories was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "enablement", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "enablement", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization" }, @@ -4633,21 +6929,31 @@ "description": "Ownership and payment for codespaces was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "owner_type", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" }, @@ -4656,16 +6962,29 @@ "description": "A team has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4675,16 +6994,29 @@ "description": "A team has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4694,19 +7026,30 @@ "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -4715,17 +7058,30 @@ "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -4734,21 +7090,30 @@ "description": "A user has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -4756,21 +7121,30 @@ "description": "A user has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -4778,16 +7152,29 @@ "description": "The interaction limit for collaborators only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "request_id", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" @@ -4797,17 +7184,30 @@ "description": "The interaction limit for prior contributors only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "operation_type", "@timestamp", - "created_at", - "user_agent", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", - "actor", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -4816,17 +7216,30 @@ "description": "The interaction limit for existing users only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", "_document_id", - "operation_type", - "actor_id", - "org_id", "action", - "created_at", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -4836,16 +7249,29 @@ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ "@timestamp", - "created_at", "_document_id", - "actor_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "action", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -4854,17 +7280,30 @@ "description": "The interaction limit for prior contributors only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "operation_type", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "org", - "created_at", - "_document_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -4873,17 +7312,30 @@ "description": "The interaction limit for existing users only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "actor_id", - "request_id", + "@timestamp", + "_document_id", "action", - "created_at", - "user_agent", "actor", - "_document_id", - "org_id", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -4892,22 +7344,30 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" }, @@ -4916,17 +7376,28 @@ "description": "An invitation for an organization to join an enterprise was confirmed.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4937,15 +7408,28 @@ "description": "Server statistics were exported for the organization.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4956,18 +7440,30 @@ "description": "An organization was created.", "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", "fields": [ - "request_id", - "org", - "actor_id", - "actor", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "org_id", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" }, @@ -4976,20 +7472,31 @@ "description": "A GitHub Actions secret was created for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -4998,20 +7505,32 @@ "description": "A GitHub Actions variable was created for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5020,21 +7539,33 @@ "description": "A Codespaces or Dependabot secret was created for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -5042,21 +7573,30 @@ "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor_id", - "org_id", - "business", - "action", "@timestamp", - "org", "_document_id", - "business_id", + "action", "actor", - "token_scopes", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "actor_is_bot", "oauth_credential_type", "managed_oauth_access_id", @@ -5071,25 +7611,33 @@ "action": "org_credential_authorization.grant", "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", - "fields": [ - "user_agent", - "actor", + "fields": [ "@timestamp", - "created_at", - "org_id", - "business_id", - "operation_type", - "request_id", "_document_id", "action", + "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", - "token_scopes", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot", "oauth_credential_type", - "request_access_security_header", "managed_oauth_access_id", "managed_token_id", "managed_oauth_scopes", @@ -5103,21 +7651,32 @@ "description": "An owner revoked authorized credentials.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "oauth_application_id", - "org_id", "operation_type", - "action", - "business", - "request_id", "created_at", - "business_id", - "actor_id", - "_document_id", - "user_agent", "oauth_credential_type", "managed_oauth_access_id", "managed_token_id", @@ -5132,20 +7691,30 @@ "description": "Team creation was limited to owners.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "actor", "@timestamp", "_document_id", - "user", - "user_id", "action", - "created_at", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -5154,16 +7723,29 @@ "description": "Third-party application access restrictions for an organization were disabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "org_id", - "action", - "_document_id", - "request_id", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" @@ -5173,19 +7755,30 @@ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -5194,14 +7787,31 @@ "description": "SAML single sign-on was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sso_url", "issuer", - "action", - "@timestamp", - "_document_id", "created_at", - "org", "operation_type" ] }, @@ -5210,21 +7820,30 @@ "description": "Display of IP addresses within audit log events for the organization was disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" }, @@ -5233,17 +7852,30 @@ "description": "A two-factor authentication requirement was disabled for the organization.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "org_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "_document_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5251,19 +7883,30 @@ "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "user", - "action", - "operation_type", "@timestamp", "_document_id", - "created_at", - "user_agent", - "org", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5271,19 +7914,30 @@ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "user", - "action", - "actor_id", - "org_id" + "created_at" ] }, { @@ -5291,19 +7945,30 @@ "description": "Team creation by members was allowed.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "org_id", - "user", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -5312,17 +7977,30 @@ "description": "Third-party application access restrictions for an organization were enabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "operation_type", - "org", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" }, @@ -5331,19 +8009,30 @@ "description": "An organization owner allowed users with read access to create discussions in an organization", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -5352,19 +8041,32 @@ "description": "SAML single sign-on was enabled for the organization.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", - "sso_url", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "@timestamp", - "issuer", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "sso_url", + "created_at", + "issuer" ], "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" }, @@ -5373,21 +8075,30 @@ "description": "Display of IP addresses within audit log events for the organization was enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" }, @@ -5396,17 +8107,30 @@ "description": "Two-factor authentication is now required for the organization.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "actor_id", - "action", - "_document_id", - "org", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" }, @@ -5415,17 +8139,30 @@ "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "org_id", - "manager", "@timestamp", - "request_id", - "actor", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "manager", + "operation_type", "created_at" ] }, @@ -5434,18 +8171,31 @@ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", "docs_reference_links": "N/A", "fields": [ - "org_id", "@timestamp", - "org", - "user_agent", - "request_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "manager", "operation_type", - "created_at", - "_document_id" + "created_at" ] }, { @@ -5453,23 +8203,32 @@ "description": "A new user was invited to join an organization.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", "fields": [ - "org", - "user_id", - "invitation_id", - "org_id", - "user", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", - "created_at", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "invitee_email", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitation_id", + "operation_type", + "created_at", + "invitee_email" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" }, @@ -5478,17 +8237,28 @@ "description": "An organization was invited to join an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5498,19 +8268,30 @@ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -5518,19 +8299,30 @@ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "org", - "org_id", - "user_agent", - "actor_id", - "user_id", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5538,19 +8330,31 @@ "description": "Access to an organization was granted for an OAuth App.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "request_id", "actor_id", - "operation_type", - "org_id", - "_document_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" @@ -5560,20 +8364,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -5582,18 +8397,31 @@ "description": "Access was disabled for an OAuth App that was previously approved.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", "fields": [ - "request_id", - "url", - "created_at", - "org_id", - "action", "@timestamp", "_document_id", - "user_agent", - "org", - "operation_type", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", + "operation_type", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" @@ -5603,19 +8431,31 @@ "description": "An organization member requested that an owner grant an OAuth App access to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", + "@timestamp", "_document_id", - "request_id", - "url", - "org_id", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "url", "oauth_application_name" ] }, @@ -5624,20 +8464,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -5647,16 +8498,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "org_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type", - "_document_id", - "org" + "created_at", + "operation_type" ] }, { @@ -5664,20 +8528,31 @@ "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "reason", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "reason", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -5686,20 +8561,30 @@ "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -5708,19 +8593,30 @@ "description": "An organization owner downloaded the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -5729,19 +8625,30 @@ "description": "An organization owner generated the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -5750,19 +8657,30 @@ "description": "An organization owner printed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -5771,19 +8689,30 @@ "description": "An organization owner viewed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -5792,19 +8721,31 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", "fields": [ - "actor", - "operation_type", "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "actor_is_bot", - "request_access_security_header" + "operation_type", + "created_at", + "actor_is_bot" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -5813,20 +8754,31 @@ "description": "A GitHub Actions secret was removed from an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5835,21 +8787,31 @@ "description": "A GitHub Actions variable was removed from an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5858,18 +8820,29 @@ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "user_id", - "user_agent", - "org_id", - "user", - "action", - "_document_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" @@ -5879,22 +8852,32 @@ "description": "A Codespaces or Dependabot secret was removed from an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -5902,21 +8885,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5924,21 +8916,30 @@ "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ - "org", - "user", - "org_id", - "created_at", - "request_id", "@timestamp", - "action", - "operation_type", - "user_agent", "_document_id", + "action", "actor", "actor_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5946,21 +8947,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -5968,18 +8979,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", "fields": [ - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "actor", - "action", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -5988,19 +9011,31 @@ "description": "An organization was renamed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "_document_id", "@timestamp", - "org", + "_document_id", "action", "actor", - "old_login", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_login", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -6008,14 +9043,28 @@ "description": "Triggered when a required workflow is created.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6026,14 +9075,28 @@ "description": "Triggered when a required workflow is deleted.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6044,14 +9107,28 @@ "description": "Triggered when a required workflow is updated.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6062,20 +9139,30 @@ "description": "An organization member was restored.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", "fields": [ - "user", - "actor", - "user_id", + "@timestamp", "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "actor_id", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" }, @@ -6084,18 +9171,29 @@ "description": "A member's linked identity was revoked.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", "user_id", - "@timestamp", - "action", - "actor_id", "user_agent", - "_document_id", - "request_id", + "operation_type", "created_at" ], "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" @@ -6105,19 +9203,30 @@ "description": "A member's SAML session was revoked.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", "fields": [ - "actor_id", - "created_at", - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" }, @@ -6126,21 +9235,33 @@ "description": "A self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" @@ -6150,21 +9271,31 @@ "description": "A self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6173,20 +9304,31 @@ "description": "A self-hosted runner group was renamed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6195,23 +9337,33 @@ "description": "The REST API was used to remove a self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -6220,23 +9372,31 @@ "description": "A self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6245,19 +9405,32 @@ "description": "A runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -6266,25 +9439,36 @@ "description": "The configuration of a self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", - "runner_group_selected_workflow_refs", - "programmatic_access_type", - "network_configuration_id", - "request_access_security_header" + "runner_group_selected_workflow_refs", + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6293,21 +9477,32 @@ "description": "The visibility of a self-hosted runner group was updated via the REST API.", "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", - "visibility", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" }, @@ -6316,21 +9511,30 @@ "description": "Automatic partner validation checks have been disabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -6340,21 +9544,30 @@ "description": "Automatic partner validation checks have been enabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -6364,20 +9577,30 @@ "description": "A custom pattern was created for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6386,22 +9609,30 @@ "description": "A custom pattern was removed from secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6410,21 +9641,30 @@ "description": "A custom pattern was published for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6433,21 +9673,30 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6456,22 +9705,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6480,21 +9737,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6503,22 +9769,30 @@ "description": "Generic secrets have been disabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -6526,22 +9800,30 @@ "description": "Generic secrets have been enabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -6549,21 +9831,30 @@ "description": "Secret scanning for non-provider patterns was disabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -6573,21 +9864,30 @@ "description": "Secret scanning for non-provider patterns was enabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -6597,19 +9897,30 @@ "description": "A role or team was added to the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -6619,21 +9930,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -6643,21 +9963,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -6667,19 +9996,30 @@ "description": "A role or team was removed from the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -6689,22 +10029,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -6713,22 +10061,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -6737,22 +10093,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -6761,21 +10125,30 @@ "description": "Push protection for secret scanning was disabled.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -6784,21 +10157,30 @@ "description": "Push protection for secret scanning was enabled.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -6807,22 +10189,30 @@ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -6831,22 +10221,30 @@ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -6855,15 +10253,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -6872,15 +10287,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -6889,7 +10321,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -6904,20 +10357,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -6926,16 +10390,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "policy", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -6946,18 +10423,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -6966,17 +10456,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", "_document_id", - "org_id", - "operation_type", + "action", "actor", "actor_id", - "@timestamp", - "request_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", - "action" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6984,18 +10487,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -7004,18 +10519,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -7024,18 +10552,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -7044,22 +10584,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", "actor_id", - "org_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issuer", - "business", "operation_type", "created_at", - "request_id", - "business_id", - "_document_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7067,21 +10617,32 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Adding organizations to your enterprise" }, @@ -7090,19 +10651,30 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -7113,15 +10685,28 @@ "description": "The organization was unarchived.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7131,19 +10716,32 @@ "description": "A user was unblocked from an organization.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", - "_document_id", "blocked_user", - "action", "operation_type", - "@timestamp", - "request_id", - "created_at", - "actor", - "actor_id", - "org", - "org_id", - "user_agent" + "created_at" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" }, @@ -7152,20 +10750,32 @@ "description": "A GitHub Actions secret was updated for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "created_at", "key", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -7174,23 +10784,34 @@ "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "updated_allowed_types", "old_policy", - "updated_access_policy", - "programmatic_access_type", - "request_access_security_header" + "updated_access_policy" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" }, @@ -7199,20 +10820,32 @@ "description": "A GitHub Actions variable was updated for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -7221,20 +10854,32 @@ "description": "The default repository permission level for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", + "created_at", "permission", - "actor_id", - "old_permission", - "_document_id", - "programmatic_access_type" + "old_permission" ] }, { @@ -7242,22 +10887,33 @@ "description": "A Codespaces or Dependabot secret was updated for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -7266,20 +10922,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -7287,17 +10954,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -7307,20 +10987,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -7329,17 +11020,30 @@ "description": "The name of the default branch was changed for new repositories in the organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" }, @@ -7348,17 +11052,30 @@ "description": "The repository self-hosted runners policy was updated", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_repo_runners_policy", "new_repo_runners_policy", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -7369,19 +11086,32 @@ "description": "An organization's SAML provider settings were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "sso_url", - "actor_id", - "operation_type", "@timestamp", - "issuer", - "org", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "operation_type", + "issuer", + "created_at" ] }, { @@ -7389,18 +11119,30 @@ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", "fields": [ - "request_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "_document_id", - "org", - "action", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" }, @@ -7409,18 +11151,30 @@ "description": "A default label was created for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", "fields": [ - "request_id", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", - "_document_id", - "action", - "created_at", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" }, @@ -7429,17 +11183,30 @@ "description": "A default label was deleted for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", "fields": [ - "operation_type", - "request_id", - "actor", "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" }, @@ -7448,17 +11215,30 @@ "description": "A default label was edited for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", "fields": [ - "org", - "created_at", "@timestamp", - "actor", + "_document_id", "action", - "user_agent", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" }, @@ -7467,20 +11247,33 @@ "description": "A domain was approved for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "org_id", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" }, @@ -7489,16 +11282,31 @@ "description": "A domain was added to an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "created_at", + "@timestamp", "_document_id", - "domain_name", "action", - "request_id", + "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "domain_name", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -7507,14 +11315,29 @@ "description": "A domain was removed from an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", "fields": [ - "action", - "domain_name", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "domain_name", "operation_type", "created_at" ], @@ -7525,16 +11348,31 @@ "description": "A domain was verified for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "domain_name", - "@timestamp", - "user_agent", - "request_id", - "actor", - "action", - "created_at", - "_document_id", - "actor_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -7543,16 +11381,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -7562,17 +11413,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7582,16 +11444,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -7601,20 +11476,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -7622,19 +11507,30 @@ "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor", - "business_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", "user_agent", - "_document_id", "created_at", - "operation_type", - "request_id", - "business" + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -7643,19 +11539,30 @@ "description": "Organization projects were disabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "operation_type", - "@timestamp", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -7664,18 +11571,29 @@ "description": "Organization projects were enabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor_id", - "org_id", - "created_at", - "user_id", - "org", "@timestamp", "_document_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", + "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" @@ -7685,23 +11603,33 @@ "description": "An organization role was assigned to a user or team.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About custom organization roles" }, @@ -7710,25 +11638,32 @@ "description": "A custom organization role was created in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", - "name", - "owner", - "role_permissions", - "base_role", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "owner", + "role_permissions", + "base_role", "created_at", "operation_type", "actor_is_bot" @@ -7740,25 +11675,32 @@ "description": "A custom organization role was deleted in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -7769,19 +11711,30 @@ "description": "A user or team was unassigned an organization role.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type" ], @@ -7792,26 +11745,33 @@ "description": "A custom organization role was edited in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", "old_role_permissions", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -7824,20 +11784,31 @@ "description": "An entire package was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" @@ -7847,23 +11818,34 @@ "description": "A package was published or republished to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "ecosystem", "version_count", "is_republished", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -7872,21 +11854,32 @@ "description": "A specific package version was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "version", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "ecosystem", "actor_is_bot" ], @@ -7897,21 +11890,34 @@ "description": "A specific package version was published or republished to a package.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "ecosystem", "package", "version", - "actor_id", - "user_agent", "is_republished", - "actor", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -7920,20 +11926,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -7942,17 +11962,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -7963,20 +11998,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -7985,18 +12034,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8004,16 +12065,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8021,18 +12096,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8040,18 +12127,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8062,18 +12162,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8084,17 +12197,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8105,18 +12231,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8128,17 +12267,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8150,20 +12302,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was created.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -8175,20 +12336,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -8200,20 +12370,29 @@ "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -8225,20 +12404,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -8250,15 +12438,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8268,17 +12471,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -8288,15 +12502,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8306,19 +12535,30 @@ "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "action", - "operation_type", "@timestamp", - "business_id", + "_document_id", + "action", + "actor", "actor_id", - "user", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8326,23 +12566,30 @@ "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "created_at", - "actor_id", + "@timestamp", "_document_id", - "actor", - "user", - "repo", "action", - "user_agent", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "request_id", - "user_id", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8350,23 +12597,30 @@ "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_id", - "operation_type", + "@timestamp", "_document_id", "action", - "@timestamp", - "repo", - "org", - "business", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org_id", - "created_at", - "business_id" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8374,17 +12628,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8394,17 +12659,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8414,17 +12690,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8434,17 +12721,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8454,17 +12752,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -8474,17 +12785,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8492,20 +12816,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -8515,17 +12850,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -8533,17 +12881,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -8551,18 +12912,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -8571,18 +12944,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -8591,19 +12976,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -8611,17 +13007,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -8633,22 +13042,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -8656,19 +13074,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -8676,17 +13105,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8694,18 +13136,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -8713,20 +13168,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8734,18 +13199,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -8754,18 +13231,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -8774,22 +13263,32 @@ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", "fields": [ - "repo", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "name", "created_at", - "_document_id", "operation_type", - "actor", - "repo_id", - "org", - "request_id", - "actor_id", - "oauth_application_id", - "@timestamp", - "programmatic_access_type" + "oauth_application_id" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" }, @@ -8798,29 +13297,34 @@ "description": "A protected branch allowance was given to a specific user, team or integration.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "authorized_actors", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -8828,24 +13332,32 @@ "description": "Branch protection was enabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "repo_id", - "user_id", "@timestamp", - "user_agent", - "repo", - "name", - "org_id", - "user", "_document_id", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", "created_at", "authorized_actor_names", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -8856,21 +13368,31 @@ "description": "Branch protection was disabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "repo", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", - "request_id", - "repo_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "name", + "operation_type", "created_at", - "_document_id", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -8881,22 +13403,32 @@ "description": "Enforcement of dismissing stale pull requests was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "dismiss_stale_reviews_on_push", - "org_id", - "action", - "created_at", - "request_id", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismiss_stale_reviews_on_push", + "created_at", "operation_type", - "actor", - "repo", - "org", - "name", - "programmatic_access_type" + "name" ] }, { @@ -8904,24 +13436,34 @@ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "authorized_actors_only", "authorized_actors", "created_at", - "user_agent", "name", - "_document_id", - "org_id", - "request_id", - "@timestamp", - "actor_id", - "org", - "action", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -8929,30 +13471,37 @@ "description": "A branch protection requirement was overridden by a repository administrator.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "actor", "reasons", - "@timestamp", "before", "after", - "actor_id", - "repo", "operation_type", - "user_agent", "branch", "overridden_codes", - "org", - "org_id", - "action", - "_document_id", - "request_id", "referrer", - "business", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "rule_suite_id" ] @@ -8962,28 +13511,36 @@ "description": "A branch update attempt was rejected.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "request_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "branch", "before", "overridden_codes", "after", - "action", "reasons", - "actor_id", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "actor_is_bot", "rule_suite_id" @@ -8994,23 +13551,32 @@ "description": "Branch protection was enforced for repository administrators.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "admin_enforced", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "name", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "action", "repo_id", - "org_id", - "_document_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "admin_enforced", + "operation_type", + "name", + "created_at" ] }, { @@ -9018,22 +13584,32 @@ "description": "Branch deletion was enabled or disabled for a protected branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "operation_type", - "request_id", - "repo", "@timestamp", - "org_id", - "org", - "action", - "allow_deletions_enforcement_level", "_document_id", - "created_at", - "actor_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_deletions_enforcement_level", + "created_at" ] }, { @@ -9041,23 +13617,32 @@ "description": "Force pushes were enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "actor_id", - "name", + "@timestamp", "_document_id", + "action", "actor", - "repo", - "operation_type", - "request_id", - "allow_force_pushes_enforcement_level", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_force_pushes_enforcement_level", + "created_at" ] }, { @@ -9065,24 +13650,33 @@ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "ignore_approvals_from_contributors", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -9091,22 +13685,32 @@ "description": "Required linear commit history was enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "operation_type", "actor", - "linear_history_requirement_enforcement_level", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "linear_history_requirement_enforcement_level", "name", - "org_id", - "repo_id", - "org", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ] }, { @@ -9114,24 +13718,33 @@ "description": "Fork syncing was enabled or disabled for a read-only branch", "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "lock_allows_fetch_and_merge", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -9140,27 +13753,34 @@ "description": "The enforcement of a branch lock was updated.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "enforcement_level", "lock_branch_enforcement_level", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -9169,18 +13789,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9191,24 +13824,33 @@ "description": "A branch name pattern was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "old_name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "old_name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -9216,25 +13858,32 @@ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", "docs_reference_links": "N/A", "fields": [ - "name", - "org_id", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "@timestamp", + "business", "business_id", - "request_id", - "pull_request_reviews_enforcement_level", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "business", - "user_agent", - "created_at", "repo_id", - "operation_type", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "pull_request_reviews_enforcement_level", + "created_at", + "operation_type" ] }, { @@ -9242,22 +13891,32 @@ "description": "Enforcement of required code owner review was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "created_at", - "require_code_owner_review", - "operation_type", - "name", - "user_agent", - "action", "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "request_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "require_code_owner_review", + "operation_type", + "name" ] }, { @@ -9265,22 +13924,33 @@ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "require_last_push_approval", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" }, @@ -9289,22 +13959,32 @@ "description": "Enforcement of the required number of approvals before merging was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "required_approving_review_count", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "required_approving_review_count", "created_at", - "actor", "operation_type", - "user_agent", - "name", - "org_id", - "action", - "actor_id", - "_document_id", - "org", - "@timestamp", - "programmatic_access_type" + "name" ] }, { @@ -9312,25 +13992,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "user_agent", "@timestamp", "_document_id", - "name", - "repo", "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "business", - "actor_id", - "operation_type", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "required_status_checks_enforcement_level", - "org", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "required_status_checks_enforcement_level" ] }, { @@ -9338,22 +14025,32 @@ "description": "Enforcement of required commit signing was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "name", "@timestamp", - "created_at", "_document_id", - "request_id", - "repo_id", - "org", - "org_id", "action", "actor", "actor_id", - "signature_requirement_enforcement_level", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "programmatic_access_type" + "operation_type", + "name", + "created_at", + "signature_requirement_enforcement_level" ] }, { @@ -9361,22 +14058,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "created_at", - "repo_id", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "name", - "actor", - "repo", "operation_type", - "action", - "strict_required_status_checks_policy", - "programmatic_access_type" + "strict_required_status_checks_policy" ] }, { @@ -9384,23 +14091,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -9409,24 +14127,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "fingerprint", "read_only", "explanation", - "repo", - "@timestamp", - "action", "key", "operation_type", - "_document_id", - "actor", "title", - "request_id", - "actor_id", - "repo_id", - "created_at", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -9435,20 +14164,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -9457,21 +14200,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -9481,22 +14237,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -9505,25 +14273,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -9532,23 +14310,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", "key", "fingerprint", - "actor_id", - "actor", "title", - "user_agent", - "user_id", - "request_id", - "read_only", - "token_scopes", - "programmatic_access_type" + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -9557,18 +14346,32 @@ "description": "A pull request was closed without being merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" @@ -9578,21 +14381,32 @@ "description": "A pull request was converted to a draft.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" }, @@ -9601,19 +14415,32 @@ "description": "A pull request was created.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -9624,23 +14451,35 @@ "description": "A review was requested on a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", "pull_request_id", - "business_id", - "org_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -9650,17 +14489,31 @@ "description": "A pull request was marked as in progress.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -9668,19 +14521,32 @@ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -9688,19 +14554,32 @@ "description": "A pull request was merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" @@ -9710,21 +14589,32 @@ "description": "A pull request was marked as ready for review.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" }, @@ -9733,27 +14623,34 @@ "description": "A pull request was rebased.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "pull_request_url", "pull_request_title", - "user", - "user_id", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9761,23 +14658,35 @@ "description": "A review request was removed from a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" }, @@ -9786,18 +14695,32 @@ "description": "A pull request was reopened after previously being closed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -9805,19 +14728,31 @@ "description": "A review comment was added to a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "comment_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -9827,20 +14762,31 @@ "description": "A review comment on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "request_id", "comment_id", - "actor_id", - "repo_id", - "action", - "operation_type", - "token_scopes", - "programmatic_access_type" + "operation_type" ] }, { @@ -9848,18 +14794,31 @@ "description": "A review comment on a pull request was changed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "request_id", - "actor_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "_document_id", - "@timestamp", - "comment_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "comment_id" ] }, { @@ -9867,21 +14826,33 @@ "description": "A review on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ] }, { @@ -9889,20 +14860,33 @@ "description": "A review on a pull request was dismissed.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" }, @@ -9911,19 +14895,33 @@ "description": "A review on a pull request was submitted.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" @@ -9933,22 +14931,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -9957,21 +14965,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -9980,25 +14997,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -10007,23 +15031,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -10032,24 +15064,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -10058,23 +15097,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -10084,22 +15131,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -10108,19 +15164,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -10129,24 +15198,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -10155,24 +15234,32 @@ "description": "Autofix for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -10180,24 +15267,32 @@ "description": "Autofix for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -10205,23 +15300,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -10232,25 +15336,31 @@ "description": "Code scanning using the default setup was disabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -10259,26 +15369,34 @@ "description": "Code scanning using the default setup was enabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "query_suite", "threat_model", - "languages", - "request_access_security_header" + "languages" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -10287,25 +15405,34 @@ "description": "Code scanning using the default setup was updated for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "query_suite", "threat_model", "languages", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Configuring default setup for code scanning" @@ -10315,19 +15442,30 @@ "description": "GitHub Codespaces was granted trusted repository access to this repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -10336,19 +15474,30 @@ "description": "GitHub Codespaces trusted repository access to this repository was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -10356,17 +15505,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -10375,15 +15537,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -10394,16 +15569,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -10413,17 +15601,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -10433,19 +15634,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -10454,17 +15666,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -10473,26 +15698,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -10501,30 +15732,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -10534,20 +15770,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -10556,25 +15803,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -10583,23 +15838,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -10607,25 +15873,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -10635,23 +15910,32 @@ "description": "A source code archive of a repository was downloaded as a ZIP file.", "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "created_at", "operation_type", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" @@ -10661,23 +15945,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -10685,21 +15979,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -10707,21 +16011,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -10729,22 +16043,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -10752,21 +16075,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -10774,20 +16107,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -10795,22 +16139,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -10818,18 +16171,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -10837,22 +16204,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -10860,21 +16237,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -10882,18 +16269,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "created_at", - "_document_id", - "request_id", - "repo_id", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -10902,22 +16301,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -10926,24 +16334,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -10952,23 +16368,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -10976,26 +16402,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -11004,21 +16435,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -11027,25 +16467,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -11053,22 +16499,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -11077,25 +16533,34 @@ "description": "A branch was renamed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "old_branch", - "new_branch", - "default_branch", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "old_branch", + "new_branch", + "default_branch", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch" @@ -11105,19 +16570,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -11125,17 +16601,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -11144,17 +16635,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -11163,7 +16669,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -11178,23 +16705,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -11204,20 +16740,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -11228,21 +16775,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -11251,22 +16809,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -11275,21 +16843,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -11298,22 +16877,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -11324,16 +16913,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -11343,22 +16943,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -11367,23 +16978,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -11393,19 +17014,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -11413,21 +17044,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -11436,24 +17077,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -11461,25 +17111,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -11488,24 +17145,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -11514,25 +17181,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -11541,22 +17216,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -11565,26 +17249,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -11592,31 +17284,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -11625,22 +17324,30 @@ "description": "Someone closed a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", "fields": [ - "actor", - "repo", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "user_agent", - "actor_id", - "request_id", - "action", - "operation_type", - "created_at", - "repo_id", - "_document_id", + "hashed_token", "org", "org_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "About repository security advisories" }, @@ -11649,18 +17356,29 @@ "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "repo", - "org_id", - "actor", + "@timestamp", + "_document_id", "action", - "request_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "_document_id", + "operation_type", "created_at" ] }, @@ -11669,17 +17387,30 @@ "description": "GitHub made a security advisory public in the GitHub Advisory Database.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -11688,21 +17419,30 @@ "description": "GitHub withdrew a security advisory that was published in error.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -11710,18 +17450,30 @@ "description": "Someone opened a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", "repo_id", - "action", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -11729,21 +17481,30 @@ "description": "Someone published a security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", "@timestamp", - "actor", - "repo_id", "_document_id", - "repo", - "business_id", - "business", - "request_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "org" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -11751,17 +17512,30 @@ "description": "Someone reopened as draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "repo", - "action", - "created_at", "@timestamp", - "request_id", - "actor_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "public_repo" ] }, @@ -11770,21 +17544,30 @@ "description": "Someone edited a draft or published security advisory.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "repo_id", - "org_id", "business", - "actor", - "user_agent", - "created_at", - "_document_id", "business_id", - "repo", - "action", - "operation_type", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -11792,24 +17575,30 @@ "description": "Branch protections were disabled for the repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -11818,24 +17607,30 @@ "description": "Branch protections were enabled for this repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -11844,19 +17639,30 @@ "description": "Data use settings were disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "repo_id", - "request_id", - "actor_id", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -11865,21 +17671,30 @@ "description": "Data use settings were enabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "org", - "user_id", - "repo_id", "@timestamp", - "request_id", - "actor", + "_document_id", "action", - "operation_type", - "created_at", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org_id", - "_document_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -11888,23 +17703,30 @@ "description": "The dependency graph was disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "repo_id", - "operation_type", - "user_id", - "repo", + "@timestamp", "_document_id", - "actor", - "user", "action", - "@timestamp", - "org_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", - "request_id", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -11913,24 +17735,31 @@ "description": "The dependency graph was enabled for a private repository.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor_id", - "repo_id", + "created_at", "operation_type", - "actor", - "@timestamp", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -11939,43 +17768,63 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", - "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "fields": [ + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -11983,21 +17832,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -12005,20 +17865,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -12026,21 +17898,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -12048,19 +17931,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -12068,19 +17964,30 @@ "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", "fields": [ - "request_id", - "created_at", + "@timestamp", "_document_id", "action", - "user_agent", - "user", - "business_id", - "business", - "operation_type", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -12089,20 +17996,30 @@ "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "created_at", "@timestamp", - "repo", - "action", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "repo_id", - "actor", - "request_id", - "programmatic_access_type" + "created_at", + "operation_type" ] }, { @@ -12111,20 +18028,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", "created_at", - "org_id", - "action", - "user_id", - "operation_type", - "_document_id", - "actor_id", - "repo" + "operation_type" ] }, { @@ -12132,31 +18058,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -12165,19 +18099,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -12185,8 +18130,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -12195,23 +18139,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -12236,26 +18189,32 @@ "description": "Automatic partner validation checks have been disabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -12264,26 +18223,32 @@ "description": "Automatic partner validation checks have been enabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -12292,23 +18257,30 @@ "description": "A custom pattern was created for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12318,23 +18290,30 @@ "description": "A custom pattern was removed from secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12344,24 +18323,31 @@ "description": "A custom pattern was published for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12371,24 +18357,31 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -12397,24 +18390,31 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12424,23 +18424,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12450,23 +18457,31 @@ "description": "Secret scanning was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "public_repo", - "programmatic_access_type" + "public_repo" ], "docs_reference_titles": "About secret scanning" }, @@ -12475,22 +18490,30 @@ "description": "Secret scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -12498,24 +18521,32 @@ "description": "Generic secrets have been disabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -12523,22 +18554,31 @@ "description": "Generic secrets have been enabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -12547,24 +18587,32 @@ "description": "Secret scanning for non-provider patterns was disabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -12573,24 +18621,32 @@ "description": "Secret scanning for non-provider patterns was enabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -12599,19 +18655,31 @@ "description": "A role or team was added to the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -12620,24 +18688,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -12646,24 +18722,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "actor_id", - "user_agent", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -12672,19 +18756,31 @@ "description": "A role or team was removed from the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -12693,26 +18789,31 @@ "description": "Secret scanning push protection was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -12721,26 +18822,31 @@ "description": "Secret scanning push protection was enabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -12749,20 +18855,30 @@ "description": "The repository visibility change setting was cleared for an organization or enterprise.", "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", "fields": [ - "created_at", + "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", "business", - "action", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business_id", - "@timestamp", "user_agent", - "actor", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise" }, @@ -12771,20 +18887,30 @@ "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user", - "org_id", - "created_at", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "_document_id", - "@timestamp", - "user_id", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -12792,19 +18918,30 @@ "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "_document_id", "@timestamp", - "user_agent", - "user", - "created_at", - "org", - "org_id", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -12812,29 +18949,37 @@ "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -12843,29 +18988,37 @@ "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", + "operation_type", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -12874,19 +19027,32 @@ "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ - "operation_type", - "request_id", - "repo_id", "@timestamp", - "user_agent", - "alert_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "alert_id", + "created_at", + "alert_number" ], "docs_reference_titles": "About Dependabot alerts" }, @@ -12895,23 +19061,32 @@ "description": "A Dependabot alert was manually dismissed.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "operation_type", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "alert_id", - "actor", - "repo", "created_at", - "org", - "_document_id", - "action", - "actor_id", "dismiss_reason", - "user", "dismiss_comment", "alert_number", "actor_is_bot" @@ -12922,21 +19097,33 @@ "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "public_repo", "owner", - "_document_id", - "@timestamp", "operation_type", - "token_scopes", "alert_number" ] }, @@ -12945,26 +19132,34 @@ "description": "A Dependabot alert was manually reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type", - "business", - "business_id", "public_repo", - "alert_number", - "request_access_security_header" + "alert_number" ] }, { @@ -12972,21 +19167,32 @@ "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", "docs_reference_links": "N/A", "fields": [ - "alert_id", - "repo", - "operation_type", - "action", - "repo_id", - "_document_id", - "user_agent", - "request_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "alert_id", + "operation_type", + "created_at", + "alert_number" ] }, { @@ -12994,20 +19200,30 @@ "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", "fields": [ - "org", + "@timestamp", "_document_id", - "repo", - "org_id", - "operation_type", - "created_at", - "actor", "action", - "@timestamp", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" }, @@ -13016,24 +19232,31 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -13041,26 +19264,32 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13068,23 +19297,30 @@ "description": "Dependabot alerts was disabled.", "docs_reference_links": "N/A", "fields": [ - "repo", - "request_id", - "repo_id", - "action", - "actor_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "_document_id", "user_id", - "operation_type", - "token_scopes", - "programmatic_access_type" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13092,23 +19328,30 @@ "description": "Dependabot alerts was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_agent", - "created_at", "@timestamp", - "repo_id", + "_document_id", "action", - "user", - "repo", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor_id", - "_document_id", - "user_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot" ] }, @@ -13117,24 +19360,31 @@ "description": "A status check was marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "org", - "actor_id", "@timestamp", - "business", - "request_id", - "context", - "repo_id", - "action", - "repo", "_document_id", - "operation_type", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "actor", - "created_at", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "context", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -13143,21 +19393,31 @@ "description": "A status check was no longer marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "actor_id", - "actor", - "created_at", - "context", - "operation_type", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "repo_id", "org_id", - "action", - "_document_id", + "programmatic_access_type", "repo", - "programmatic_access_type" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "context", + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -13166,18 +19426,31 @@ "description": "Email notification restrictions for an organization or enterprise were disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -13186,19 +19459,31 @@ "description": "Email notification restrictions for an organization or enterprise were enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -13207,22 +19492,33 @@ "description": "A new custom repository role was created.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "owner", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", - "_document_id", "role_permissions", "old_role_permissions" ], @@ -13233,23 +19529,34 @@ "description": "A custom repository role was deleted.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Managing custom repository roles for an organization" }, @@ -13258,23 +19565,34 @@ "description": "A custom repository role was edited.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "old_role_permissions", "old_base_role" ], @@ -13285,14 +19603,28 @@ "description": "GitHub detected a secret and created a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -13306,22 +19638,32 @@ "description": "A secret scanning alert was reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type_display_name" ] }, @@ -13330,28 +19672,37 @@ "description": "A secret scanning alert was resolved.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "resolution", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", + "resolution", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type", "secret_type_display_name", "publicly_leaked", - "multi_repo", - "request_access_security_header" + "multi_repo" ] }, { @@ -13359,25 +19710,32 @@ "description": "A secret scanning alert was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -13385,14 +19743,28 @@ "description": "A secret scanning alert was validated.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "previous_validity", @@ -13409,19 +19781,30 @@ "description": "Secret scanning was disabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -13430,19 +19813,30 @@ "description": "Secret scanning was enabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -13451,20 +19845,30 @@ "description": "Secret scanning was disabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -13473,19 +19877,30 @@ "description": "Secret scanning was enabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -13494,14 +19909,28 @@ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "push_protection_bypass_reason", @@ -13519,25 +19948,33 @@ "description": "A request to bypass secret scanning push protection was approved by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -13546,25 +19983,33 @@ "description": "A request to bypass secret scanning push protection was denied by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", - "request_access_security_header", "request_reviewer_comment" ], "docs_reference_titles": "About push protection" @@ -13574,25 +20019,33 @@ "description": "A user requested to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" }, @@ -13601,16 +20054,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -13620,18 +20086,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -13640,16 +20119,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -13659,15 +20151,28 @@ "description": "An agreement for invoiced billing for GitHub Sponsors was signed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -13679,15 +20184,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -13697,15 +20215,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -13714,17 +20247,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -13733,17 +20279,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -13752,16 +20312,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -13771,14 +20344,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -13788,17 +20376,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -13807,17 +20408,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -13826,18 +20440,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -13846,15 +20473,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -13864,16 +20505,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13881,15 +20535,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -13900,16 +20567,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "@timestamp", - "_document_id", "user_agent", - "actor_id", - "user", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -13919,17 +20599,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -13940,17 +20633,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -13961,18 +20667,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -13982,16 +20699,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14001,16 +20731,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14022,17 +20765,30 @@ "fields": [ "@timestamp", "_document_id", - "fingerprint", - "operation_type", - "openssh_public_key", - "org_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "request_id" + "fingerprint", + "operation_type", + "openssh_public_key", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -14041,19 +20797,32 @@ "description": "An SSH certificate authority for an organization or enterprise was deleted.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "created_at", + "@timestamp", "_document_id", - "fingerprint", - "operation_type", + "action", "actor", - "org_id", - "openssh_public_key", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", - "request_id" + "created_at", + "fingerprint", + "operation_type", + "openssh_public_key" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -14062,21 +20831,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "user", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "request_id", - "org", - "org_id", - "created_at", - "actor", "action", - "user_id", + "actor", + "actor_id", "business", "business_id", - "@timestamp", - "actor_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -14085,19 +20863,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "actor_id", - "user_id", - "org", - "operation_type", - "request_id", "@timestamp", "_document_id", - "actor", - "user", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -14106,15 +20895,28 @@ "description": "Dependabot encrypted config was read.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "public_repo" @@ -14125,20 +20927,34 @@ "description": "The verification code expiry time for an organization or enterprise domain was set.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "token_expires_at", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14146,18 +20962,33 @@ "description": "An organization or enterprise domain was unverified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ] }, { @@ -14165,16 +20996,31 @@ "description": "An organization or enterprise domain was verified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "domain_name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14182,21 +21028,31 @@ "description": "A member of an organization was added to a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", "fields": [ - "user_agent", - "request_id", - "org_id", - "user_id", - "team", - "user", "@timestamp", - "actor_id", - "created_at", - "operation_type", "_document_id", - "org", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" @@ -14206,22 +21062,31 @@ "description": "A team was given access and permissions to a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "team", - "action", - "operation_type", - "request_id", - "created_at", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "actor_id", - "_document_id", "repo_id", - "user_agent", - "org_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -14230,20 +21095,31 @@ "description": "A child team was created or a child team's parent was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", "fields": [ - "org", "@timestamp", - "created_at", "_document_id", - "team", "action", - "operation_type", "actor", - "request_id", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", + "operation_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" }, @@ -14252,18 +21128,31 @@ "description": "A team's privacy level was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", "fields": [ - "user_agent", - "request_id", - "org", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", "created_at", "operation_type", - "actor_id", - "org_id", - "@timestamp", - "actor", - "_document_id", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" @@ -14273,21 +21162,32 @@ "description": "A new team is created.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "oauth_application_id", + "operation_type", "team", - "org", - "actor", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "team_type" ] }, @@ -14296,21 +21196,31 @@ "description": "A user was demoted from a team maintainer to a team member.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" }, @@ -14319,19 +21229,31 @@ "description": "A team was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "team", "org_id", - "actor_id", - "actor", - "action", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", "operation_type", - "_document_id", - "programmatic_access_type", "team_type" ] }, @@ -14340,19 +21262,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "business_id", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", "actor_id", - "user", "business", - "action", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14360,19 +21293,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "operation_type", - "request_id", "actor", - "org", - "created_at", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", - "_document_id" + "operation_type", + "created_at" ] }, { @@ -14380,18 +21324,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", "@timestamp", - "action", "_document_id", - "user_agent", - "user_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business", + "user_id", + "user_agent", "operation_type", - "actor", "created_at" ] }, @@ -14400,19 +21355,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "actor", - "action", - "operation_type", - "team", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "team" ] }, { @@ -14420,19 +21387,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", "@timestamp", - "actor_id", "_document_id", - "team", - "created_at", - "org_id", "action", - "request_id", - "user_agent", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_access_security_header" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "team", + "created_at" ] }, { @@ -14440,22 +21419,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "team", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at" ] }, { @@ -14463,22 +21451,31 @@ "description": "A user was promoted from a team member to a team maintainer.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" }, @@ -14487,22 +21484,31 @@ "description": "An organization member was removed from a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", "fields": [ - "request_id", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "team", - "user_id", - "actor", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", + "user_id", "user_agent", - "_document_id", - "token_scopes", - "programmatic_access_type", + "operation_type", + "created_at", + "team", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" @@ -14510,23 +21516,33 @@ { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A", - "fields": [ - "request_id", - "org_id", - "repo", - "repo_id", - "action", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "created_at", "team", - "org", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -14534,21 +21550,32 @@ "description": "A team's name was changed.", "docs_reference_links": "N/A", "fields": [ - "name", - "user_agent", - "created_at", - "team", - "operation_type", - "actor_id", - "org", + "@timestamp", + "_document_id", "action", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "_document_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "team", + "operation_type", "team_type" ] }, @@ -14557,17 +21584,30 @@ "description": "Team synchronization with a tenant was disabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "request_id", - "org_id", "actor_id", - "operation_type", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -14576,19 +21616,30 @@ "description": "Team synchronization with a tenant was enabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ - "org_id", - "business_id", - "actor", - "created_at", - "user_agent", "@timestamp", - "operation_type", - "business", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -14597,19 +21648,30 @@ "description": "The Okta credentials for team synchronization with a tenant were changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -14617,28 +21679,37 @@ "description": "A team's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "team", - "org_id", "@timestamp", - "org", "_document_id", - "old_permission", - "request_id", - "repo", "action", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "old_permission", "operation_type", "created_at", - "user_agent", "permission", "new_repo_permission", "new_repo_base_role", "old_repo_permission", - "old_repo_base_role", - "token_scopes", - "programmatic_access_type" + "old_repo_base_role" ] }, { @@ -14646,16 +21717,30 @@ "description": "A Dependabot rule was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14665,16 +21750,30 @@ "description": "A Dependabot rule was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14684,18 +21783,31 @@ "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14705,21 +21817,33 @@ "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -14727,21 +21851,32 @@ "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -14749,21 +21884,32 @@ "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -14771,16 +21917,30 @@ "description": "A Dependabot rule's conditions, actions, or metadata changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14790,27 +21950,33 @@ "description": "A workflow job was approved.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", - "repo", - "repo_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -14819,23 +21985,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -14843,10 +22019,28 @@ "description": "A workflow run was cancelled.", "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -14857,20 +22051,9 @@ "run_number", "cancelled_at", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Canceling a workflow run" }, @@ -14879,23 +22062,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14905,10 +22096,28 @@ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -14920,19 +22129,9 @@ "conclusion", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -14943,10 +22142,28 @@ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -14955,21 +22172,10 @@ "head_branch", "head_sha", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "public_repo", - "programmatic_access_type", "actor_is_bot", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "Understanding GitHub Actions" @@ -14979,23 +22185,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -15004,22 +22222,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15027,21 +22256,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -15049,25 +22289,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15075,23 +22323,36 @@ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", "fields": [ - "repo_id", - "repo", - "org_id", - "org", - "business_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "job_name", "runner_labels", "is_hosted_runner", "environment_name", "secrets_passed", - "action", - "_document_id", "operation_type", "created_at", - "@timestamp", "runner_owner_type", "job_workflow_ref", "calling_workflow_refs", @@ -15105,24 +22366,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -15131,10 +22401,28 @@ "description": "A workflow run was re-run.", "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -15144,21 +22432,11 @@ "head_sha", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", "rerun_type", "check_run_id", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "Re-running workflows and jobs" @@ -15168,25 +22446,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.14/user.json b/src/audit-logs/data/ghes-3.14/user.json index a5aecbaf6331..315369a09f99 100644 --- a/src/audit-logs/data/ghes-3.14/user.json +++ b/src/audit-logs/data/ghes-3.14/user.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,17 +67,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "request_id", "@timestamp", - "user_agent", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", - "user_id", + "token_scopes", "user", - "actor", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -61,18 +98,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", + "token_scopes", "user", - "request_id", - "_document_id", - "user_agent", - "actor", "user_id", - "actor_id", - "operation_type", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -80,18 +129,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "actor_id", - "operation_type", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "token_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -99,29 +160,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -129,18 +196,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -148,17 +227,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -167,19 +259,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -188,18 +292,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -207,18 +324,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -226,15 +355,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -244,17 +386,30 @@ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "created_at", "operation_type" ], @@ -265,20 +420,32 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -287,19 +454,32 @@ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "limit", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -308,19 +488,31 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -329,20 +521,32 @@ "description": "The policy for fork pull request workflows was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -351,19 +555,31 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -372,20 +588,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -394,20 +621,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -418,17 +656,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -436,14 +686,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -453,25 +718,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -482,22 +756,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -509,22 +794,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -533,15 +829,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -552,17 +863,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -572,27 +896,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "org", "owner", "pull_request_id", "machine_type", - "user_id", - "user", "devcontainer_path", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -600,38 +933,63 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "owner", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" - ] - }, - { - "action": "codespaces.trusted_repositories_access_update", - "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", - "fields": [ - "user_agent", - "request_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", + "operation_type", "created_at", - "_document_id" + "public_repo" + ] + }, + { + "action": "codespaces.trusted_repositories_access_update", + "description": "A personal account's access and security setting for Codespaces were updated.", + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -640,23 +998,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -664,16 +1029,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -682,24 +1061,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -707,15 +1092,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -725,20 +1123,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -746,19 +1154,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -766,65 +1186,92 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "business", - "business_id" - ] - }, - { - "action": "custom_hosted_runner.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "name", - "runner_group_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] }, { - "action": "custom_hosted_runner.destroy", + "action": "custom_hosted_runner.create", "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", + "created_at", + "operation_type" + ] + }, + { + "action": "custom_hosted_runner.destroy", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -834,21 +1281,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -858,19 +1314,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -879,19 +1346,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -900,19 +1378,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -921,19 +1410,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -942,17 +1442,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -960,19 +1473,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -981,39 +1505,61 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" - ] - }, - { - "action": "dependabot_security_updates_new_repos.disable", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1022,19 +1568,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1042,19 +1599,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1063,19 +1631,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1083,19 +1662,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1104,20 +1694,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1125,22 +1725,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1149,22 +1758,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1172,28 +1791,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "business", "business_id", - "public_repo", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "visibility", + "operation_type", + "created_at", + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1202,27 +1827,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -1231,25 +1864,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1258,26 +1899,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1286,21 +1934,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1309,22 +1969,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1333,25 +2003,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1360,22 +2039,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1384,23 +2075,33 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", - "new_value", - "approvers_was", - "approvers", "programmatic_access_type", - "can_admins_bypass", - "prevent_self_review" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "new_value", + "approvers_was", + "approvers", + "can_admins_bypass", + "prevent_self_review" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1409,21 +2110,32 @@ "description": "A gist was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "gist_id", - "@timestamp", "created_at", "operation_type", - "user_agent", - "actor", - "actor_id", - "visibility", - "action", - "_document_id", - "token_scopes", - "programmatic_access_type" + "visibility" ] }, { @@ -1431,20 +2143,32 @@ "description": "A gist was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "gist_id", - "visibility", - "created_at", + "@timestamp", "_document_id", - "user", - "request_id", - "operation_type", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "@timestamp", - "programmatic_access_type" + "gist_id", + "visibility", + "created_at", + "operation_type" ] }, { @@ -1452,21 +2176,32 @@ "description": "The visibility of a gist was updated.", "docs_reference_links": "N/A", "fields": [ - "action", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", - "user", - "gist_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "visibility", - "user_id", - "created_at", - "_document_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "gist_id", + "visibility", + "created_at" ] }, { @@ -1474,22 +2209,33 @@ "description": "An SSH key was added to a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -1498,23 +2244,34 @@ "description": "An SSH key was removed from a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", "explanation", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -1523,23 +2280,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1547,18 +2313,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1569,20 +2345,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1592,37 +2378,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "created_at", - "user_id", "@timestamp", - "user", - "operation_type", "_document_id", - "actor", "action", - "user_agent", - "request_access_security_header" - ] - }, - { - "action": "gpg_key.destroy", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "gpg_key.destroy", "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "created_at", - "_document_id", + "user_id", "user_agent", - "@timestamp", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -1630,25 +2440,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -1656,25 +2476,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -1682,26 +2511,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -1710,25 +2548,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -1736,26 +2583,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -1763,21 +2619,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -1786,41 +2653,65 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "actor_id", - "request_id", "@timestamp", - "name", - "integration", - "user", "_document_id", "action", - "operation_type", - "created_at", - "user_agent" - ] - }, - { - "action": "integration.generate_client_secret", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", "operation_type", + "created_at" + ] + }, + { + "action": "integration.generate_client_secret", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -1829,19 +2720,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -1852,20 +2757,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -1875,24 +2792,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -1903,23 +2831,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -1930,20 +2870,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -1953,19 +2906,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -1974,20 +2941,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -1997,20 +2977,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -2019,20 +3012,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -2041,20 +3047,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -2062,19 +3080,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2083,19 +3114,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2104,17 +3148,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2127,21 +3184,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -2155,17 +3225,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2177,18 +3260,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2196,43 +3291,69 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", - "user_id", - "user_agent", - "operation_type", - "created_at", - "request_id", + "action", + "actor", "actor_id", - "marketplace_listing", - "integration", - "action" - ] - }, - { + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "secondary_category", + "primary_category", + "operation_type", + "created_at", + "marketplace_listing", + "integration" + ] + }, + { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -2240,22 +3361,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -2263,19 +3397,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -2286,21 +3433,36 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "actor", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", "marketplace_listing", "has_free_trial", - "user_agent", - "request_id", - "actor_id", "yearly_price_in_cents", "description", "bullets", "monthly_price_in_cents", - "marketplace_listing_plan", - "_document_id" + "marketplace_listing_plan" ] }, { @@ -2308,22 +3470,37 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "marketplace_listing_plan", "marketplace_listing", "description", "bullets", "has_free_trial", "created_at", - "actor_id", "operation_type", - "_document_id", - "action", - "user_agent", - "request_id", - "actor", "monthly_price_in_cents", - "yearly_price_in_cents", - "@timestamp" + "yearly_price_in_cents" ] }, { @@ -2331,21 +3508,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor", - "marketplace_listing_plan", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "marketplace_listing_plan", "description", "yearly_price_in_cents", - "@timestamp", "created_at", - "actor_id", "bullets", "has_free_trial", "marketplace_listing", - "user_agent", "monthly_price_in_cents", - "action", "operation_type" ] }, @@ -2354,21 +3546,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "monthly_price_in_cents", - "marketplace_listing", + "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "monthly_price_in_cents", + "marketplace_listing", "description", "bullets", "yearly_price_in_cents", - "request_id", - "actor_id", "has_free_trial", "marketplace_listing_plan", - "user_agent", - "@timestamp", "operation_type", - "actor", "created_at" ] }, @@ -2377,22 +3584,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -2400,22 +3620,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2423,19 +3656,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2443,21 +3688,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2467,16 +3721,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2486,18 +3753,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2507,14 +3787,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -2522,19 +3818,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -2542,18 +3849,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2561,23 +3880,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -2585,20 +3912,30 @@ "description": "An OAuth access token was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", "fields": [ - "_document_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "user", - "user_id", - "created_at", + "_document_id", "action", + "actor", "actor_id", - "request_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" @@ -2609,19 +3946,30 @@ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", "fields": [ "@timestamp", - "user_agent", - "action", - "operation_type", "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_id", + "user_agent", + "operation_type", + "created_at", "explanation", - "hashed_token", - "actor_id", - "token_scopes", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" @@ -2631,19 +3979,30 @@ "description": "An OAuth access token was regenerated.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "_document_id", - "created_at", "@timestamp", - "operation_type", + "_document_id", "action", - "user_agent", - "request_id", "actor", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "oauth_application_name" ] }, @@ -2652,18 +4011,30 @@ "description": "An OAuth access token was updated.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -2671,20 +4042,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2693,20 +4076,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2715,20 +4110,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2737,20 +4144,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2759,19 +4178,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2780,20 +4212,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2802,20 +4246,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2824,19 +4280,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2845,24 +4314,31 @@ "description": "An authorization for an OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ - "operation_type", - "user_agent", - "user_id", - "actor", - "org_id", + "@timestamp", "_document_id", - "request_id", "action", - "@timestamp", - "created_at", + "actor", "actor_id", - "user", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_is_bot", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -2872,20 +4348,31 @@ "description": "An authorization for an OAuth application was deleted.", "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", "fields": [ - "user_agent", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "actor", "created_at", "explanation", - "user", - "user_id", - "org_id", - "action", - "actor_id", - "token_scopes", "actor_is_bot", "oauth_application_name" ], @@ -2896,21 +4383,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -2919,24 +4416,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2944,20 +4451,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -2965,22 +4482,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -2988,20 +4513,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -3009,22 +4544,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -3032,21 +4575,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3054,20 +4606,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -3076,16 +4639,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -3096,18 +4672,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -3116,18 +4705,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -3136,18 +4737,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -3156,18 +4770,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -3177,20 +4803,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -3198,17 +4835,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -3218,20 +4868,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -3240,20 +4901,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -3262,17 +4937,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3283,20 +4973,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -3305,19 +5009,31 @@ "description": "A new passkey was added.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3325,19 +5041,31 @@ "description": "A new passkey was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3345,18 +5073,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3364,16 +5104,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3381,18 +5135,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -3400,18 +5166,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3422,18 +5201,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3444,17 +5236,30 @@ "description": "Triggered when you create a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3464,19 +5269,31 @@ "description": "Triggered when you regenerate a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3484,12 +5301,29 @@ "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", "fields": [ - "user_programmatic_access_name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", "operation_type" ], @@ -3500,20 +5334,32 @@ "description": "Triggered when you delete a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "explanation", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3521,17 +5367,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -3542,18 +5401,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -3565,17 +5437,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -3587,17 +5472,30 @@ "description": "A fine-grained personal access token was updated.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3608,15 +5506,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3626,17 +5539,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -3646,15 +5570,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3664,17 +5603,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -3684,17 +5634,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -3704,17 +5665,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -3724,17 +5696,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -3744,17 +5727,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -3764,17 +5760,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3782,20 +5791,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -3805,17 +5825,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -3823,17 +5856,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -3841,18 +5887,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -3861,18 +5919,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -3881,19 +5951,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -3901,17 +5982,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -3923,22 +6017,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -3946,19 +6049,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -3966,17 +6080,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3984,39 +6111,62 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", - "user_agent", - "actor" - ] - }, - { - "action": "project.update_user_permission", - "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A", - "fields": [ - "request_id", - "user_id", - "operation_type", - "@timestamp", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "actor", "created_at", - "org", + "operation_type", + "team" + ] + }, + { + "action": "project.update_user_permission", + "description": "A user was added to or removed from a project board or had their permission level changed.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", "_document_id", - "org_id", "action", - "programmatic_access_type" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4024,18 +6174,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -4044,18 +6206,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -4064,18 +6238,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4086,23 +6273,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -4111,24 +6309,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -4137,20 +6346,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4159,21 +6382,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -4183,22 +6419,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4207,25 +6455,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4234,23 +6492,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", "key", "fingerprint", - "actor_id", - "actor", "title", - "user_agent", - "user_id", - "request_id", - "read_only", - "token_scopes", - "programmatic_access_type" + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4259,22 +6528,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -4283,21 +6562,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -4306,25 +6594,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -4333,23 +6628,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -4358,24 +6661,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -4384,23 +6694,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -4410,22 +6728,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -4434,19 +6761,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -4455,24 +6795,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -4481,23 +6831,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4508,17 +6867,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -4527,15 +6899,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -4546,16 +6931,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -4565,17 +6963,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -4585,19 +6996,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -4606,17 +7028,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -4625,26 +7060,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -4653,30 +7094,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -4686,20 +7132,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -4708,25 +7165,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -4735,23 +7200,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -4759,25 +7235,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -4787,23 +7272,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -4811,21 +7306,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -4833,21 +7338,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", - "action", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -4855,22 +7370,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -4878,21 +7402,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -4900,20 +7434,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -4921,22 +7466,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -4944,18 +7498,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4963,22 +7531,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4986,21 +7564,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -5008,42 +7596,63 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", - "repo_id", - "request_access_security_header" - ], - "docs_reference_titles": "Adding self-hosted runners" - }, - { - "action": "repo.remove_actions_secret", - "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", - "fields": [ - "user_agent", - "request_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", + "created_at" + ], + "docs_reference_titles": "Adding self-hosted runners" + }, + { + "action": "repo.remove_actions_secret", + "description": "A GitHub Actions secret was deleted for a repository.", + "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", + "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5052,24 +7661,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5078,23 +7695,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -5102,26 +7729,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -5130,21 +7762,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -5153,25 +7794,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -5179,22 +7826,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -5203,43 +7860,63 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" - ] + "operation_type", + "created_at" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -5249,20 +7926,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -5273,21 +7961,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -5296,22 +7995,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -5320,21 +8029,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -5343,22 +8063,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -5369,16 +8099,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -5387,22 +8128,31 @@ "description": "Temporary access was enabled for a repository.", "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing user-owned repositories in your enterprise" }, @@ -5412,22 +8162,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -5436,23 +8197,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", - "new_nwo", - "visibility", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "new_nwo", + "visibility", + "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -5462,19 +8233,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -5482,21 +8263,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -5505,24 +8296,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -5530,25 +8330,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5557,24 +8364,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -5583,25 +8400,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5610,22 +8435,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -5634,26 +8468,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -5661,31 +8503,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -5694,21 +8543,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -5716,21 +8575,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -5738,21 +8607,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -5760,20 +8640,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -5781,21 +8673,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -5803,19 +8706,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -5823,31 +8739,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -5856,19 +8780,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -5876,8 +8811,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -5886,23 +8820,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -5927,18 +8870,30 @@ "description": "A security key was registered for an account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "created_at", - "user_id", - "action", - "operation_type", - "request_id", "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -5946,18 +8901,30 @@ "description": "A security key was removed from an account.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "operation_type", - "_document_id", - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5965,16 +8932,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5984,18 +8964,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -6004,16 +8997,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6024,15 +9030,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -6042,15 +9061,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -6059,17 +9093,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -6078,35 +9125,62 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", - "actor", - "actor_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" - }, - { - "action": "sponsors.sponsor_sponsorship_preference_change", - "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", - "fields": [ - "actor_id", - "action", "@timestamp", - "request_id", - "user_id", - "created_at", - "user", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + }, + { + "action": "sponsors.sponsor_sponsorship_preference_change", + "description": "The option to receive email updates from a sponsored account was changed.", + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -6116,14 +9190,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -6133,17 +9222,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -6152,17 +9254,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -6171,18 +9286,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6191,15 +9319,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -6209,16 +9351,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6226,15 +9381,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -6245,16 +9413,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -6264,17 +9445,30 @@ "description": "Triggered when you send an email update to your sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", "fields": [ - "request_id", - "actor", - "action", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" }, @@ -6283,17 +9477,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -6304,17 +9511,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -6325,18 +9545,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6346,16 +9577,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6365,17 +9609,30 @@ "description": "You join the waitlist to join GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "actor_id", - "action", "operation_type", - "created_at", - "user", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -6384,16 +9641,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6403,15 +9673,30 @@ "description": "Triggered when you accept a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6420,15 +9705,30 @@ "description": "Triggered when you cancel a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6437,15 +9737,30 @@ "description": "Triggered when you create a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6454,15 +9769,30 @@ "description": "Triggered when you decline a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6471,15 +9801,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6487,15 +9832,30 @@ "description": "Triggered when you revoke a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6504,17 +9864,30 @@ "description": "A new trusted device was added.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6522,17 +9895,30 @@ "description": "A trusted device was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6540,14 +9926,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "action", - "request_id", - "user_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -6556,15 +9957,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "created_at", - "user_id", - "operation_type", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action" + "created_at", + "operation_type" ] }, { @@ -6572,13 +9988,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "created_at", - "user_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6586,17 +10019,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "operation_type", - "action", - "_document_id" + "created_at", + "operation_type" ] }, { @@ -6604,17 +10050,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user", - "created_at", - "request_id", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -6622,32 +10081,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "operation_type", "@timestamp", - "user_agent", - "request_id", - "created_at", - "user_id", - "action", "_document_id", - "request_access_security_header" - ] - }, - { - "action": "two_factor_account_recovery.two_factor_destroy", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "two_factor_account_recovery.two_factor_destroy", "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_id", - "action", "@timestamp", - "created_at", - "user_agent", - "user", "_document_id", - "request_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6655,18 +10143,30 @@ "description": "A secondary authentication factor was added to a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -6675,18 +10175,30 @@ "description": "Two-factor authentication was disabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", "fields": [ - "actor", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor_id", + "user_agent", "created_at", - "operation_type", - "request_id", - "@timestamp", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Disabling two-factor authentication for your personal account" }, @@ -6695,18 +10207,30 @@ "description": "Two-factor authentication was enabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ - "actor", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Configuring two-factor authentication" }, @@ -6715,15 +10239,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user", - "user_id", - "action", "@timestamp", - "request_id", "_document_id", - "user_agent" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6731,16 +10270,29 @@ "description": "Two factor recovery codes were regenerated for a user account.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", + "operation_type", "created_at" ] }, @@ -6749,18 +10301,30 @@ "description": "A secondary authentication factor was removed from a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -6769,15 +10333,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "created_at", - "_document_id", - "action", - "@timestamp" + "operation_type", + "created_at" ] }, { @@ -6786,16 +10365,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "operation_type", "user_agent", - "action", - "request_id", - "actor", - "actor_id" + "created_at", + "operation_type" ] }, { @@ -6803,19 +10395,31 @@ "description": "An email address was added to a user account.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", "fields": [ - "action", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", "operation_type", - "_document_id", - "actor_id", - "actor", "email", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding an email address to your GitHub account" }, @@ -6824,18 +10428,30 @@ "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "created_at", - "user", "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -6843,15 +10459,28 @@ "description": "Audit log entries were exported.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "action", - "request_id", - "actor", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", "created_at" ] @@ -6861,20 +10490,31 @@ "description": "A user was blocked by another user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_id", - "_document_id", "actor_id", - "@timestamp", - "user_agent", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -6882,18 +10522,30 @@ "description": "A user changed their password.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "actor_id", - "operation_type", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "created_at", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6901,18 +10553,30 @@ "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -6921,17 +10585,30 @@ "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -6940,19 +10617,31 @@ "description": "A new user account was created.", "docs_reference_links": "N/A", "fields": [ - "email", - "user_id", - "operation_type", "@timestamp", - "request_id", - "user", - "created_at", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "action", - "programmatic_access_type" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "email", + "operation_type", + "created_at" ] }, { @@ -6960,21 +10649,33 @@ "description": "A user secret for Codespaces was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -6982,39 +10683,62 @@ "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "user_agent", + "@timestamp", "_document_id", - "operation_type", - "oauth_application_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "@timestamp", + "token_id", "token_scopes", - "programmatic_access_type" - ] - }, + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" + ] + }, { "action": "user.delete", "description": "A user account was destroyed by an asynchronous job.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "request_id", - "user_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7023,19 +10747,30 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "oauth_application_id", + "_document_id", "action", - "user", - "created_at", - "user_agent", - "request_id", "actor", "actor_id", - "operation_type", - "_document_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", + "operation_type" ] }, { @@ -7043,18 +10778,30 @@ "description": "A user deleted his or her account, triggering user.async_delete.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", - "created_at", - "user_agent", "user_id", - "operation_type", - "actor_id", - "action", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7062,18 +10809,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "user_agent", "user_id", - "actor_id", - "action", - "operation_type", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7081,18 +10840,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "operation_type", - "created_at", - "_document_id", - "@timestamp", - "user", - "actor_id", - "action", - "request_access_security_header" + "created_at" ] }, { @@ -7101,17 +10872,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user", "_document_id", "action", - "operation_type", - "user_agent", - "created_at", - "request_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7119,17 +10902,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7137,17 +10933,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7155,17 +10964,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7173,21 +10995,31 @@ "description": "An enterprise managed user claimed an email address.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "actor_is_bot", - "request_access_security_header" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -7195,21 +11027,31 @@ "description": "N/A", "docs_reference_links": "An enterprise managed user unclaimed an email address.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." }, @@ -7218,17 +11060,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7236,17 +11091,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7254,17 +11122,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7272,18 +11153,30 @@ "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "action", - "operation_type", - "request_id", - "created_at", - "_document_id", "@timestamp", - "user", - "org_id", + "_document_id", + "action", "actor", "actor_id", - "user_agent" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7291,17 +11184,31 @@ "description": "A user requested a password reset.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", "fields": [ - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "email", - "created_at", - "user_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" }, @@ -7310,17 +11217,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "created_at", - "user_agent", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor", - "operation_type", - "request_id" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7328,18 +11248,30 @@ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -7348,19 +11280,31 @@ "description": "A user signed in.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "actor_id", "@timestamp", - "user", - "action", - "operation_type", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "actor", - "passkey_nickname", - "request_access_security_header" + "passkey_nickname" ] }, { @@ -7368,18 +11312,30 @@ "description": "A user signed out.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7387,18 +11343,30 @@ "description": "A user signed in from a new device.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7406,21 +11374,31 @@ "description": "An ordinary user account was promoted to a site administrator.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", + "user_id", "user_agent", + "created_at", "oauth_application_id", - "request_id", - "operation_type", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7428,16 +11406,29 @@ "description": "A user's account was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user", - "action", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "actor", "operation_type" ] }, @@ -7446,20 +11437,31 @@ "description": "An email address was removed from a user account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "actor", - "actor_id", "created_at", - "email", - "token_scopes", - "programmatic_access_type" + "email" ] }, { @@ -7467,20 +11469,32 @@ "description": "A user secret for Codespaces was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "key", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "key", + "integration", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7488,20 +11502,31 @@ "description": "A username was changed.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "request_id", - "actor_id", - "old_login", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "operation_type", "user_agent", - "token_scopes", - "programmatic_access_type" + "old_login", + "created_at", + "operation_type" ] }, { @@ -7509,18 +11534,30 @@ "description": "A user reset their account password.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "@timestamp", - "_document_id", - "actor", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7528,16 +11565,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_id", - "action", "@timestamp", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -7548,16 +11598,28 @@ "fields": [ "@timestamp", "_document_id", - "request_id", - "user_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor_id", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -7566,18 +11628,30 @@ "description": "A user signed in from an unrecognized device.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "action", + "@timestamp", "_document_id", - "user_agent", - "user", - "user_id", - "operation_type", - "created_at", + "action", "actor", "actor_id", - "@timestamp", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7585,18 +11659,30 @@ "description": "A user signed in from an unrecognized device and location.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "created_at", - "_document_id", - "request_id", - "action", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7604,22 +11690,33 @@ "description": "Triggered when you clear the status on your profile.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "message", - "user", - "actor_id", "created_at", - "request_id", "limited_availability", - "action", "emoji", - "operation_type", - "user_agent", - "@timestamp", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -7627,23 +11724,33 @@ "description": "Triggered when you set or change the status on your profile.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", "fields": [ - "limited_availability", - "user", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "message", - "user_id", - "created_at", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "limited_availability", + "message", + "created_at", "emoji", - "org", - "actor", - "operation_type", - "token_scopes", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Personalize your profile" }, @@ -7652,21 +11759,31 @@ "description": "A user account was suspended.", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", - "operation_type", - "actor_id", - "user", - "user_agent", - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", - "user_id", + "_document_id", "action", - "token_scopes", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -7674,18 +11791,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", - "actor_id", "@timestamp", - "operation_type", "_document_id", - "user_agent", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7693,18 +11822,30 @@ "description": "A 2FA challenge issued for a user account failed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "_document_id", - "user_agent", - "user", - "actor_id", - "actor", - "user_id", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7714,16 +11855,28 @@ "fields": [ "@timestamp", "_document_id", - "user_id", - "operation_type", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "actor", + "user_id", "user_agent", - "request_id", - "action", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -7731,18 +11884,30 @@ "description": "A user used their 2FA recovery codes.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "user_agent", - "request_id", - "user", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "created_at", - "@timestamp", - "_document_id", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7750,18 +11915,30 @@ "description": "A user downloaded 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -7769,17 +11946,30 @@ "description": "A user printed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", - "user_agent", - "request_id", - "user_id", - "created_at", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7787,18 +11977,30 @@ "description": "A user viewed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", "created_at", - "user", - "operation_type", - "@timestamp", - "request_id", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -7806,17 +12008,30 @@ "description": "A user was prompted for a two-factor authentication code.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", "fields": [ - "user", - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "actor" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" }, @@ -7825,19 +12040,31 @@ "description": "A user was unblocked by another user.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "actor", - "@timestamp", - "user_agent", - "user_id", - "user", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -7845,21 +12072,31 @@ "description": "A user account was unsuspended.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", - "user", "action", - "user_agent", "actor", - "oauth_application_id", - "operation_type", "actor_id", - "created_at", - "@timestamp", - "user_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -7867,21 +12104,33 @@ "description": "A user secret for Codespaces was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7889,46 +12138,64 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", + "operation_type" + ] + }, + { + "action": "workflows.approve_workflow_job", + "description": "A workflow job was approved.", + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" - ] - }, - { - "action": "workflows.approve_workflow_job", - "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", - "fields": [ "user_agent", - "request_id", - "actor", - "actor_id", "workflow_run_id", "run_number", - "user", - "user_id", - "repo", - "repo_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -7937,23 +12204,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7961,23 +12238,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -7987,23 +12272,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -8012,22 +12309,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8035,21 +12343,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -8057,25 +12376,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8083,24 +12410,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -8109,25 +12445,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.15/enterprise.json b/src/audit-logs/data/ghes-3.15/enterprise.json index 9f24bc326ce9..eb46d115068d 100644 --- a/src/audit-logs/data/ghes-3.15/enterprise.json +++ b/src/audit-logs/data/ghes-3.15/enterprise.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,17 +67,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "request_id", "@timestamp", - "user_agent", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", - "user_id", + "token_scopes", "user", - "actor", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -61,18 +98,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", + "token_scopes", "user", - "request_id", - "_document_id", - "user_agent", - "actor", "user_id", - "actor_id", - "operation_type", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -80,18 +129,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "actor_id", - "operation_type", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "token_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -99,29 +160,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -129,31 +196,34 @@ "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests", "fields": [ - "user_agent", - "request_id", - "request_method", - "query_string", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", - "request_body", - "status_code", - "url_path", "business", "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "request_method", + "query_string", + "request_body", + "status_code", + "url_path", + "public_repo", "created_at", "operation_type", "route", @@ -167,18 +237,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -186,20 +268,32 @@ "description": "A manual check of the endpoint configured for audit log streaming was performed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "audit_log_stream_result", - "business_id", "business", - "action", - "_document_id", - "@timestamp", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_result", "created_at", "operation_type", - "audit_log_stream_sink_details", - "request_access_security_header" + "audit_log_stream_sink_details" ] }, { @@ -207,18 +301,31 @@ "description": "An endpoint was added for audit log streaming.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "business_id", "business", - "audit_log_stream_sink", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_sink", + "created_at", + "operation_type", "audit_log_stream_id" ] }, @@ -227,15 +334,28 @@ "description": "An audit log streaming endpoint was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "business_id", "business", - "action", - "_document_id", - "@timestamp", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "audit_log_stream_id", @@ -247,17 +367,30 @@ "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "audit_log_stream_enabled", - "business_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_enabled", "audit_log_stream_sink", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "new_s3_bucket", @@ -280,17 +413,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -299,19 +445,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -320,18 +478,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -339,18 +510,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -358,15 +541,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -376,22 +572,31 @@ "description": "An enterprise owner was added to an enterprise.", "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", "fields": [ - "name", - "business", - "user", - "user_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "request_id", + "business", "business_id", - "_document_id", - "user_agent", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "operation_type" ], "docs_reference_titles": "Inviting people to manage your enterprise" }, @@ -400,22 +605,32 @@ "description": "An organization was added to an enterprise.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "operation_type", "name", "created_at", - "request_id", - "_document_id", - "business", - "organization_upgrade", - "request_access_security_header" + "organization_upgrade" ] }, { @@ -423,20 +638,30 @@ "description": "GitHub Advanced Security was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ - "actor", - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -445,17 +670,28 @@ "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -466,21 +702,31 @@ "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -489,17 +735,28 @@ "description": "GitHub Advanced Security was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -510,17 +767,28 @@ "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -531,21 +799,31 @@ "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -554,20 +832,32 @@ "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "new_policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "new_policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -576,20 +866,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -597,17 +899,28 @@ "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -619,21 +932,31 @@ "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -642,18 +965,31 @@ "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -662,17 +998,30 @@ "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", "fields": [ - "name", - "operation_type", - "business_id", - "user_agent", - "actor_id", - "request_id", - "actor", + "@timestamp", "_document_id", - "business", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -682,19 +1031,32 @@ "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", "business_id", - "action", - "_document_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "business", "visibility", "created_at", - "actor", - "operation_type", - "@timestamp" + "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -703,21 +1065,33 @@ "description": "The policy for Code scanning autofix was updated for an enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -725,19 +1099,31 @@ "description": "An enterprise was created.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", "_document_id", "action", - "@timestamp", - "request_id", - "name", + "actor", + "actor_id", "business", "business_id", - "operation_type", - "actor", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "name", + "operation_type", + "created_at" ] }, { @@ -745,17 +1131,28 @@ "description": "Dependabot alerts were disabled for new repositories in your enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -765,17 +1162,28 @@ "description": "Dependabot alerts were enabled for new repositories in your enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -785,17 +1193,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -805,18 +1226,30 @@ "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -824,17 +1257,28 @@ "description": "Display of IP addresses within audit log events for the enterprise was disabled.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -845,18 +1289,31 @@ "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.", "docs_reference_links": "N/A", "fields": [ - "action", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", "business", - "operation_type", - "created_at", - "user_agent", "business_id", - "actor_id", - "name", - "_document_id", - "request_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "name" ] }, { @@ -864,15 +1321,28 @@ "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -882,17 +1352,28 @@ "description": "Display of IP addresses within audit log events for the enterprise was enabled.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -903,18 +1384,31 @@ "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "operation_type", - "created_at", + "actor_id", "business", "business_id", - "name", - "_document_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "name" ] }, { @@ -922,20 +1416,31 @@ "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", "actor_id", - "@timestamp", - "request_id", "business", - "name", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "business_id", - "_document_id" + "created_at", + "name", + "operation_type" ] }, { @@ -943,20 +1448,31 @@ "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -964,20 +1480,31 @@ "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "name", - "actor", - "operation_type", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "business", - "actor_id", - "created_at", - "action", + "user_id", "user_agent", - "request_id", - "user_id" + "name", + "operation_type", + "created_at" ] }, { @@ -985,20 +1512,31 @@ "description": "An enterprise owner was removed from an enterprise.", "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", - "user_agent", + "actor_id", "business", "business_id", - "@timestamp", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "name", - "actor_id", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", - "user" + "user_agent", + "operation_type", + "created_at", + "name" ], "docs_reference_titles": "Inviting people to manage your enterprise" }, @@ -1007,20 +1545,31 @@ "description": "An organization was removed from an enterprise.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "business", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "business_id", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "name", - "org" + "name" ] }, { @@ -1028,18 +1577,31 @@ "description": "The slug for the enterprise URL was renamed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "name", - "business_id", - "user_agent", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", - "@timestamp", - "created_at", + "actor_id", "business", - "_document_id" + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ] }, { @@ -1047,20 +1609,31 @@ "description": "The SAML single sign-on session for a member in an enterprise was revoked.", "docs_reference_links": "N/A", "fields": [ - "business_id", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "actor", - "_document_id", - "actor_id", "name", - "@timestamp", - "user_id", - "action", - "created_at", - "business" + "created_at" ] }, { @@ -1068,17 +1641,28 @@ "description": "Automatic partner validation checks have been disabled at the business level", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1089,17 +1673,28 @@ "description": "Automatic partner validation checks have been enabled at the business level", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1110,20 +1705,30 @@ "description": "An enterprise-level custom pattern was created for secret scanning.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -1132,17 +1737,28 @@ "description": "An enterprise-level custom pattern was removed from secret scanning.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1152,20 +1768,30 @@ "description": "An enterprise-level custom pattern was published for secret scanning.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1173,17 +1799,28 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1194,20 +1831,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -1216,17 +1863,28 @@ "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1236,17 +1894,28 @@ "description": "Secret scanning was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1257,17 +1926,28 @@ "description": "Secret scanning was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -1278,17 +1958,28 @@ "description": "Secret scanning was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1299,17 +1990,28 @@ "description": "Secret scanning was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1320,17 +2022,28 @@ "description": "Secret scanning for non-provider patterns was disabled at the enterprise level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1342,17 +2055,28 @@ "description": "Secret scanning for non-provider patterns was enabled at the enterprise level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1364,17 +2088,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1385,17 +2120,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1406,17 +2152,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1427,17 +2184,28 @@ "description": "Push protection for secret scanning was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1448,17 +2216,28 @@ "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1469,17 +2248,28 @@ "description": "Push protection for secret scanning was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1490,17 +2280,28 @@ "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -1511,20 +2312,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1532,17 +2345,30 @@ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "created_at", "operation_type" ], @@ -1553,20 +2379,32 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1575,19 +2413,32 @@ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "limit", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1596,19 +2447,31 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1617,20 +2480,32 @@ "description": "The policy for fork pull request workflows was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1639,19 +2514,31 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1660,20 +2547,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "issuer", - "name", - "user_agent", - "action", "@timestamp", "_document_id", + "action", "actor", + "actor_id", "business", "business_id", - "actor_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "issuer", + "name", + "created_at", + "operation_type" ] }, { @@ -1681,46 +2580,72 @@ "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "updated_github_owned_allowed", - "updated_verified_allowed", - "updated_patterns", - "new_policy", - "old_policy", - "updated_access_policy" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { - "action": "business.update_default_repository_permission", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "updated_github_owned_allowed", + "updated_verified_allowed", + "updated_patterns", + "new_policy", + "old_policy", + "updated_access_policy" + ], + "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" + }, + { + "action": "business.update_default_repository_permission", "description": "The base repository permission setting was updated for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", "fields": [ - "business_id", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "permission", - "action", "created_at", - "@timestamp", - "request_id", "name", - "_document_id", - "old_permission", - "business" + "old_permission" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -1729,19 +2654,32 @@ "description": "The repository creation setting was updated for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation", "fields": [ - "created_at", + "@timestamp", "_document_id", - "request_id", - "name", - "business_id", + "action", "actor", "actor_id", - "@timestamp", - "operation_type", - "permission", - "action", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "name", + "operation_type", + "permission", "visibility" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -1751,19 +2689,32 @@ "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories", "fields": [ - "business_id", - "created_at", - "action", - "operation_type", "@timestamp", - "request_id", - "permission", + "_document_id", + "action", "actor", "actor_id", - "name", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "business" + "created_at", + "operation_type", + "permission", + "name" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -1772,20 +2723,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -1794,20 +2756,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -1818,17 +2791,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -1836,14 +2821,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1853,25 +2853,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -1882,22 +2891,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", - "repository", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -1909,22 +2929,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -1933,15 +2964,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -1952,17 +2998,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1972,27 +3031,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "org", "owner", "pull_request_id", "machine_type", - "user_id", - "user", "devcontainer_path", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2000,19 +3068,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -2020,18 +3101,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -2040,23 +3133,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2064,16 +3164,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -2082,40 +3196,59 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "request_access_security_header" - ] - }, - { + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { "action": "copilot.cfb_seat_assignment_reused", "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -2125,20 +3258,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2146,19 +3289,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -2166,21 +3321,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -2188,21 +3352,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2212,19 +3385,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -2234,21 +3416,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2258,18 +3449,31 @@ "description": "A new custom property definition was created.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -2282,18 +3486,31 @@ "description": "A custom property definition was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -2307,14 +3524,29 @@ "description": "A custom property definition was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "value_type", @@ -2327,8 +3559,7 @@ "old_default_value", "old_value_type", "old_values_editable_by", - "values_editable_by", - "request_access_security_header" + "values_editable_by" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2337,27 +3568,35 @@ "description": "A repository's custom property value was manually set for the first time.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2366,19 +3605,31 @@ "description": "A repository's custom property value was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2387,16 +3638,29 @@ "description": "A repository's custom property value was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "definition_id" @@ -2408,19 +3672,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -2429,19 +3704,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -2450,19 +3736,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -2471,19 +3768,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -2492,17 +3800,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2510,40 +3831,62 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependabot_security_updates.enable", - "description": "Dependabot security updates were enabled for all existing repositories.", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + }, + { + "action": "dependabot_security_updates.enable", + "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2551,19 +3894,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -2572,19 +3926,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2592,19 +3957,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -2613,19 +3989,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2633,19 +4020,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -2654,20 +4052,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2675,21 +4083,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "team", - "created_at", - "user_id", "@timestamp", - "number", - "org", - "title", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", "user_agent", - "operation_type", - "_document_id" + "team", + "created_at", + "number", + "title", + "operation_type" ] }, { @@ -2697,18 +4117,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user_id", - "actor", "number", - "user", - "created_at", - "request_id", - "_document_id" + "created_at" ] }, { @@ -2716,18 +4149,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "action", - "_document_id", - "request_id", - "org", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org_id", "user_agent", - "actor", + "operation_type", "number", "team", "created_at" @@ -2738,21 +4182,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "_document_id", - "title", - "user", - "user_agent", - "org", - "operation_type", - "actor_id", "@timestamp", - "actor", - "team", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", + "title", + "operation_type", + "team", "number" ] }, @@ -2761,17 +4216,31 @@ "description": "A global announcement banner was created for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2782,16 +4251,30 @@ "description": "A global announcement banner was removed from the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2802,18 +4285,32 @@ "description": "A global announcement banner was updated for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", "old_message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2824,23 +4321,31 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise" }, @@ -2849,19 +4354,33 @@ "description": "A domain was approved for an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -2870,18 +4389,33 @@ "description": "A domain was added to an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -2890,18 +4424,33 @@ "description": "A domain was removed from an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -2910,18 +4459,33 @@ "description": "A domain was verified for an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -2930,18 +4494,30 @@ "description": "A new GitHub Actions self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -2950,20 +4526,30 @@ "description": "A GitHub Actions self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -2972,18 +4558,31 @@ "description": "A GitHub Actions self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows" ], "docs_reference_titles": "Removing self-hosted runners" @@ -2993,18 +4592,31 @@ "description": "A GitHub Actions self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3013,20 +4625,33 @@ "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -3035,19 +4660,31 @@ "description": "A GitHub Actions self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3056,19 +4693,32 @@ "description": "A GitHub Actions runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -3077,24 +4727,36 @@ "description": "The configuration of a GitHub Actions self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3103,14 +4765,32 @@ "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -3119,14 +4799,32 @@ "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -3135,18 +4833,36 @@ "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", "target_version", "runner_group_id", "runner_group_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Self-hosted runners" }, @@ -3155,22 +4871,32 @@ "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "business_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "user", - "business", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3178,21 +4904,33 @@ "description": "A license for GitHub Copilot was assigned to an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3200,17 +4938,30 @@ "description": "A license for GitHub Copilot was unassigned from an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3221,17 +4972,30 @@ "description": "A new enterprise team was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3241,17 +5005,30 @@ "description": "An enterprise team was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3262,22 +5039,32 @@ "description": "A member was removed from the enterprise team or an IdP group linked to an enterprise team, or an IdP group was unlinked from an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "business_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "user", - "business", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3285,18 +5072,31 @@ "description": "The name of an enterprise team was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "business_id", - "enterprise_team_id", - "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", + "enterprise_team_id", + "enterprise_team", "created_at", "operation_type", "actor_is_bot" @@ -3307,22 +5107,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3331,22 +5140,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3354,28 +5173,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3384,27 +5209,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -3413,25 +5246,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3440,26 +5281,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3468,21 +5316,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -3491,22 +5351,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3515,25 +5385,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3542,22 +5421,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -3566,21 +5457,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -3591,27 +5492,33 @@ "description": "A user was added to an external group.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "external_group", - "external_group_id", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "external_group", + "external_group_id", "created_at", "operation_type", - "business", - "business_id", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -3619,19 +5526,31 @@ "description": "An external group was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at", "scim_group_id" ] }, @@ -3640,22 +5559,33 @@ "description": "An external group was linked to a GitHub team.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "external_group", - "programmatic_access_type", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -3663,21 +5593,31 @@ "description": "An external group was created.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -3685,26 +5625,32 @@ "description": "A user was removed from an external group.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "external_group", - "external_group_id", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "external_group", + "external_group_id", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -3712,31 +5658,39 @@ "description": "Failed external group SCIM API request.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", "status_code", "url_path", "scim_group_id", - "message", - "action", - "_document_id", - "@timestamp", + "message", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -3745,30 +5699,38 @@ "description": "Successful external group SCIM API request. Excludes GET API requests.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", "status_code", "url_path", "scim_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -3777,18 +5739,31 @@ "description": "An external group was unlinked to a GitHub team.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "external_group" ] }, @@ -3797,22 +5772,32 @@ "description": "An external group was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "scim_group_id", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at", + "scim_group_id" ] }, { @@ -3820,25 +5805,33 @@ "description": "An external group's display name was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", "external_group", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -3846,20 +5839,31 @@ "description": "An external identity was deprovisioned, suspending the linked GitHub user.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -3867,17 +5871,31 @@ "description": "An external identity was created and linked to a GitHub user.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "scim_user_id", - "request_access_security_header" + "scim_user_id" ] }, { @@ -3885,15 +5903,29 @@ "description": "Failed external identity SCIM API request.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", @@ -3901,15 +5933,9 @@ "url_path", "scim_user_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -3918,30 +5944,38 @@ "description": "Successful external identity SCIM API request. Excludes GET API requests.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", "status_code", "url_path", "scim_user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -3950,18 +5984,31 @@ "description": "An external identity was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "scim_user_id", - "request_access_security_header" + "scim_user_id" ] }, { @@ -3969,21 +6016,32 @@ "description": "A gist was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "gist_id", - "@timestamp", "created_at", "operation_type", - "user_agent", - "actor", - "actor_id", - "visibility", - "action", - "_document_id", - "token_scopes", - "programmatic_access_type" + "visibility" ] }, { @@ -3991,20 +6049,32 @@ "description": "A gist was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "gist_id", - "visibility", - "created_at", + "@timestamp", "_document_id", - "user", - "request_id", - "operation_type", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "@timestamp", - "programmatic_access_type" + "gist_id", + "visibility", + "created_at", + "operation_type" ] }, { @@ -4012,21 +6082,32 @@ "description": "The visibility of a gist was updated.", "docs_reference_links": "N/A", "fields": [ - "action", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", - "user", - "gist_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "visibility", - "user_id", - "created_at", - "_document_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "gist_id", + "visibility", + "created_at" ] }, { @@ -4034,19 +6115,30 @@ "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4055,20 +6147,30 @@ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4077,19 +6179,30 @@ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4098,22 +6211,33 @@ "description": "An SSH key was added to a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -4122,48 +6246,68 @@ "description": "An SSH key was removed from a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", "explanation", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", + "operation_type" + ], + "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + }, + { + "action": "github_hosted_runner.create", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "request_access_security_header" - ], - "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" - }, - { - "action": "github_hosted_runner.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "actor", - "actor_id", + "user", + "user_id", "user_agent", - "request_id", "name", "runner_group_id", - "business", - "user", - "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4171,18 +6315,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -4193,20 +6347,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -4216,18 +6380,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "created_at", - "user_id", "@timestamp", - "user", - "operation_type", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -4235,18 +6411,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "created_at", - "_document_id", + "user_id", "user_agent", - "@timestamp", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -4254,25 +6442,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -4280,25 +6478,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -4306,26 +6513,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -4334,25 +6550,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", - "repo", - "created_at", - "org", - "name", - "request_id", "actor_id", - "repo_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "operation_type", - "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "events", + "created_at", + "name", + "operation_type", + "oauth_application_id", + "hook_id" ] }, { @@ -4360,26 +6585,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -4387,21 +6621,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -4410,19 +6655,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -4430,21 +6688,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -4453,19 +6722,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -4476,20 +6759,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -4499,24 +6794,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -4527,23 +6833,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -4554,20 +6872,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -4577,19 +6908,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -4598,20 +6943,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -4621,20 +6979,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -4643,20 +7014,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -4665,20 +7049,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -4686,19 +7082,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -4707,19 +7116,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -4728,44 +7150,70 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", + "created_at", + "operation_type", + "application_client_id" + ], + "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation" + }, + { + "action": "integration.transfer", + "description": "Ownership of a GitHub App was transferred to another user or organization.", + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "application_client_id" - ], - "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation" - }, - { - "action": "integration.transfer", - "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", - "fields": [ - "@timestamp", - "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -4779,17 +7227,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -4801,19 +7262,30 @@ "description": "An IP allow list was disabled.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "actor", - "request_id", - "org", - "user_agent", + "@timestamp", "_document_id", - "user_id", + "action", + "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "@timestamp", - "user" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4821,19 +7293,30 @@ "description": "An IP allow list was disabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -4841,17 +7324,28 @@ "description": "IP allow list user level enforcement was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4861,20 +7355,29 @@ "description": "An IP allow list was enabled.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "user_id", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "business_id", - "_document_id", - "action", - "@timestamp", + "user_id", "user_agent", - "actor_id", "operation_type", - "org", "created_at" ] }, @@ -4883,19 +7386,30 @@ "description": "An IP allow list was enabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -4903,17 +7417,28 @@ "description": "IP allow list user level enforcement was enabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4923,24 +7448,32 @@ "description": "An IP address was added to an IP allow list.", "docs_reference_links": "N/A", "fields": [ - "active", - "org", - "ip_allow_list_entry", "@timestamp", "_document_id", - "operation_type", - "created_at", - "user_agent", "action", - "request_id", + "actor", "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "business", - "actor", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", + "ip_allow_list_entry", + "operation_type", + "created_at" ] }, { @@ -4948,24 +7481,32 @@ "description": "An IP address was deleted from an IP allow list.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "ip_allow_list_entry", - "org", "operation_type", "created_at", - "active", - "action", - "@timestamp", - "business", - "business_id", - "user_agent", - "org_id", - "actor", - "actor_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "active" ] }, { @@ -4973,19 +7514,32 @@ "description": "An IP address or its description was changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "actor_id", "ip_allow_list_entry", - "active", - "org_id", - "@timestamp" + "active" ] }, { @@ -4993,18 +7547,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5012,21 +7578,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -5034,21 +7613,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -5056,22 +7648,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -5079,19 +7684,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -5102,21 +7720,36 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "actor", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", "marketplace_listing", "has_free_trial", - "user_agent", - "request_id", - "actor_id", "yearly_price_in_cents", "description", "bullets", "monthly_price_in_cents", - "marketplace_listing_plan", - "_document_id" + "marketplace_listing_plan" ] }, { @@ -5124,22 +7757,37 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "marketplace_listing_plan", "marketplace_listing", "description", "bullets", "has_free_trial", "created_at", - "actor_id", "operation_type", - "_document_id", - "action", - "user_agent", - "request_id", - "actor", "monthly_price_in_cents", - "yearly_price_in_cents", - "@timestamp" + "yearly_price_in_cents" ] }, { @@ -5147,21 +7795,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor", - "marketplace_listing_plan", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "marketplace_listing_plan", "description", "yearly_price_in_cents", - "@timestamp", "created_at", - "actor_id", "bullets", "has_free_trial", "marketplace_listing", - "user_agent", "monthly_price_in_cents", - "action", "operation_type" ] }, @@ -5170,21 +7833,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "monthly_price_in_cents", - "marketplace_listing", + "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "monthly_price_in_cents", + "marketplace_listing", "description", "bullets", "yearly_price_in_cents", - "request_id", - "actor_id", "has_free_trial", "marketplace_listing_plan", - "user_agent", - "@timestamp", "operation_type", - "actor", "created_at" ] }, @@ -5193,22 +7871,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -5216,22 +7907,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -5239,19 +7943,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5259,21 +7975,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5283,16 +8008,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5302,18 +8040,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5323,14 +8074,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -5338,19 +8105,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -5358,18 +8136,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5377,23 +8167,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -5401,20 +8199,30 @@ "description": "An OAuth access token was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", "fields": [ - "_document_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "user", - "user_id", - "created_at", + "_document_id", "action", + "actor", "actor_id", - "request_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" @@ -5425,19 +8233,30 @@ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", "fields": [ "@timestamp", - "user_agent", - "action", - "operation_type", "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_id", + "user_agent", + "operation_type", + "created_at", "explanation", - "hashed_token", - "actor_id", - "token_scopes", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" @@ -5447,19 +8266,30 @@ "description": "An OAuth access token was regenerated.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "_document_id", - "created_at", "@timestamp", - "operation_type", + "_document_id", "action", - "user_agent", - "request_id", "actor", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "oauth_application_name" ] }, @@ -5468,18 +8298,30 @@ "description": "An OAuth access token was updated.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -5487,20 +8329,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5509,20 +8363,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5531,20 +8397,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5553,20 +8431,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "oauth_application", - "oauth_application_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5575,19 +8465,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5596,20 +8499,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5618,20 +8533,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5641,18 +8568,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user_agent", - "org_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "oauth_application_id", - "action", "created_at", - "actor", - "actor_id", - "oauth_application", - "_document_id", - "request_id" + "oauth_application" ] }, { @@ -5660,19 +8600,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5681,15 +8634,32 @@ "description": "An OAuth application was unsuspended for a user or organization account.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "operation_type", - "org_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "oauth_application_id", "oauth_application", - "org", - "created_at", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5698,24 +8668,31 @@ "description": "An authorization for an OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ - "operation_type", - "user_agent", - "user_id", - "actor", - "org_id", + "@timestamp", "_document_id", - "request_id", "action", - "@timestamp", - "created_at", + "actor", "actor_id", - "user", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_is_bot", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -5725,20 +8702,31 @@ "description": "An authorization for an OAuth application was deleted.", "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", "fields": [ - "user_agent", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "actor", "created_at", "explanation", - "user", - "user_id", - "org_id", - "action", - "actor_id", - "token_scopes", "actor_is_bot", "oauth_application_name" ], @@ -5749,20 +8737,31 @@ "description": "An authorization for an OAuth application was updated.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", - "actor_id", "user_agent", - "@timestamp", "operation_type", - "action", - "user", "created_at", - "_document_id", "actor_is_bot", - "request_access_security_header", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -5772,17 +8771,28 @@ "description": "An invitation sent to an organization to join an enterprise was accepted.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5793,20 +8803,30 @@ "description": "A billing manager was added to an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "org", - "user_id", "action", - "created_at", - "org_id", - "user", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" }, @@ -5815,21 +8835,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -5838,24 +8868,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5863,21 +8903,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -5885,20 +8935,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -5906,22 +8966,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -5929,20 +8997,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -5950,22 +9028,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "business", - "business_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -5973,19 +9059,30 @@ "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -5994,19 +9091,30 @@ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -6016,16 +9124,29 @@ "description": "A user initiated a background job to delete an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "@timestamp", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "created_at" ] }, @@ -6034,16 +9155,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_agent", - "action", "@timestamp", - "actor_id", - "org_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -6052,18 +9186,31 @@ "description": "An organization owner blocked a user from accessing the organization's repositories.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", "fields": [ - "actor", - "user_agent", - "org_id", - "created_at", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "blocked_user", + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" }, @@ -6072,19 +9219,30 @@ "description": "An invitation for an organization to join an enterprise was revoked", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "initiated_from" ], "docs_reference_titles": "Adding organizations to your enterprise" @@ -6094,22 +9252,33 @@ "description": "An invitation sent to a user to join an organization was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "email", - "@timestamp", - "actor", - "action", "operation_type", - "user_agent", - "org", "invitation_id", - "_document_id", "created_at", - "invitee_email", - "token_scopes", - "programmatic_access_type" + "invitee_email" ] }, { @@ -6117,19 +9286,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -6137,23 +9317,31 @@ "description": "Autofix for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6161,21 +9349,31 @@ "description": "Autofix for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6183,21 +9381,30 @@ "description": "Code scanning using the default setup was disabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -6206,21 +9413,30 @@ "description": "Code scanning using the default setup was enabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -6229,16 +9445,29 @@ "description": "The interaction limit for collaborators only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "request_id", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" @@ -6248,17 +9477,30 @@ "description": "The interaction limit for prior contributors only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "operation_type", "@timestamp", - "created_at", - "user_agent", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", - "actor", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6267,17 +9509,30 @@ "description": "The interaction limit for existing users only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", "_document_id", - "operation_type", - "actor_id", - "org_id", "action", - "created_at", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6287,16 +9542,29 @@ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ "@timestamp", - "created_at", "_document_id", - "actor_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "action", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6305,17 +9573,30 @@ "description": "The interaction limit for prior contributors only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "operation_type", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6324,17 +9605,30 @@ "description": "The interaction limit for existing users only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "actor_id", - "request_id", + "@timestamp", + "_document_id", "action", - "created_at", - "user_agent", "actor", - "_document_id", - "org_id", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6343,22 +9637,30 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" }, @@ -6367,17 +9669,28 @@ "description": "An invitation for an organization to join an enterprise was confirmed.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6388,18 +9701,30 @@ "description": "An organization was created.", "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", "fields": [ - "request_id", - "org", - "actor_id", - "actor", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "org_id", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" }, @@ -6408,18 +9733,30 @@ "description": "An organization was deleted by a user or staff.", "docs_reference_links": "N/A", "fields": [ - "user_agent", "@timestamp", "_document_id", - "created_at", - "actor", - "org_id", - "org", "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6427,20 +9764,30 @@ "description": "Team creation was limited to owners.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "actor", "@timestamp", "_document_id", - "user", - "user_id", "action", - "created_at", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -6449,19 +9796,30 @@ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -6470,14 +9828,31 @@ "description": "SAML single sign-on was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sso_url", "issuer", - "action", - "@timestamp", - "_document_id", "created_at", - "org", "operation_type" ] }, @@ -6486,17 +9861,30 @@ "description": "A two-factor authentication requirement was disabled for the organization.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "org_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "_document_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6504,19 +9892,30 @@ "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "user", - "action", - "operation_type", "@timestamp", "_document_id", - "created_at", - "user_agent", - "org", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6524,19 +9923,30 @@ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "user", - "action", - "actor_id", - "org_id" + "created_at" ] }, { @@ -6544,19 +9954,30 @@ "description": "Team creation by members was allowed.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "org_id", - "user", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -6565,19 +9986,30 @@ "description": "An organization owner allowed users with read access to create discussions in an organization", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "created_at", - "org", - "org_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -6586,19 +10018,32 @@ "description": "SAML single sign-on was enabled for the organization.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", - "sso_url", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "@timestamp", - "issuer", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "sso_url", + "created_at", + "issuer" ], "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" }, @@ -6607,17 +10052,30 @@ "description": "Two-factor authentication is now required for the organization.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "actor_id", - "action", - "_document_id", - "org", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" }, @@ -6626,17 +10084,30 @@ "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "org_id", - "manager", "@timestamp", - "request_id", - "actor", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "manager", + "operation_type", "created_at" ] }, @@ -6645,18 +10116,31 @@ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", "docs_reference_links": "N/A", "fields": [ - "org_id", "@timestamp", - "org", - "user_agent", - "request_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "manager", "operation_type", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6664,23 +10148,32 @@ "description": "A new user was invited to join an organization.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", "fields": [ - "org", - "user_id", - "invitation_id", - "org_id", - "user", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", - "created_at", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "invitee_email", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitation_id", + "operation_type", + "created_at", + "invitee_email" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" }, @@ -6689,17 +10182,28 @@ "description": "An organization was invited to join an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -6709,19 +10213,30 @@ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6729,19 +10244,30 @@ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "org", - "org_id", - "user_agent", - "actor_id", - "user_id", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6750,16 +10276,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "org_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type", - "_document_id", - "org" + "created_at", + "operation_type" ] }, { @@ -6767,17 +10306,30 @@ "description": "An organization was restored.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "org_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6785,19 +10337,31 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", "fields": [ - "actor", - "operation_type", "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "actor_is_bot", - "request_access_security_header" + "operation_type", + "created_at", + "actor_is_bot" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -6806,18 +10370,29 @@ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "user_id", - "user_agent", - "org_id", - "user", - "action", - "_document_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" @@ -6827,21 +10402,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6849,21 +10433,30 @@ "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ - "org", - "user", - "org_id", - "created_at", - "request_id", "@timestamp", - "action", - "operation_type", - "user_agent", "_document_id", + "action", "actor", "actor_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6871,21 +10464,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -6893,18 +10496,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", "fields": [ - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "actor", - "action", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -6913,19 +10528,31 @@ "description": "An organization was renamed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "_document_id", "@timestamp", - "org", + "_document_id", "action", "actor", - "old_login", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_login", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -6933,20 +10560,30 @@ "description": "An organization member was restored.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", "fields": [ - "user", - "actor", - "user_id", + "@timestamp", "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "actor_id", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" }, @@ -6955,21 +10592,33 @@ "description": "A self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", "runner_group_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" @@ -6979,21 +10628,31 @@ "description": "A self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7002,23 +10661,33 @@ "description": "The REST API was used to remove a self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -7027,23 +10696,31 @@ "description": "A self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7052,19 +10729,32 @@ "description": "A runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -7073,25 +10763,36 @@ "description": "The configuration of a self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7100,21 +10801,30 @@ "description": "Automatic partner validation checks have been disabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -7124,21 +10834,30 @@ "description": "Automatic partner validation checks have been enabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -7148,20 +10867,30 @@ "description": "A custom pattern was created for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7170,22 +10899,30 @@ "description": "A custom pattern was removed from secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7194,21 +10931,30 @@ "description": "A custom pattern was published for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7217,21 +10963,30 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7240,22 +10995,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7264,21 +11027,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7287,21 +11059,30 @@ "description": "Secret scanning for non-provider patterns was disabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7311,21 +11092,30 @@ "description": "Secret scanning for non-provider patterns was enabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7335,19 +11125,30 @@ "description": "A role or team was added to the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7357,21 +11158,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7381,21 +11191,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7405,19 +11224,30 @@ "description": "A role or team was removed from the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7427,22 +11257,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7451,22 +11289,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7475,22 +11321,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7499,21 +11353,30 @@ "description": "Push protection for secret scanning was disabled.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7522,21 +11385,30 @@ "description": "Push protection for secret scanning was enabled.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7545,22 +11417,30 @@ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7569,22 +11449,30 @@ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7593,26 +11481,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7620,28 +11516,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7649,26 +11553,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7676,15 +11588,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -7693,15 +11622,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -7710,7 +11656,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -7725,20 +11692,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -7747,16 +11725,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -7767,18 +11758,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -7787,17 +11791,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", "_document_id", - "org_id", - "operation_type", + "action", "actor", "actor_id", - "@timestamp", - "request_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", - "action" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7805,18 +11822,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -7825,18 +11854,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "policy", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -7845,18 +11887,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -7865,22 +11919,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", "actor_id", - "org_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issuer", - "business", "operation_type", "created_at", - "request_id", - "business_id", - "_document_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7888,19 +11952,31 @@ "description": "A user account was converted into an organization.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization", "fields": [ - "actor", + "@timestamp", "_document_id", - "request_id", - "operation_type", + "action", + "actor", "actor_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "@timestamp", - "created_at", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "owner", - "request_access_security_header" + "operation_type", + "created_at", + "owner" ], "docs_reference_titles": "Converting a user into an organization" }, @@ -7909,19 +11985,32 @@ "description": "A user was unblocked from an organization.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", "fields": [ - "oauth_application_id", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", - "@timestamp", - "request_id", - "created_at", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "blocked_user", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" }, @@ -7930,23 +12019,34 @@ "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "updated_allowed_types", "old_policy", - "updated_access_policy", - "programmatic_access_type", - "request_access_security_header" + "updated_access_policy" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" }, @@ -7955,20 +12055,32 @@ "description": "The default repository permission level for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", + "created_at", "permission", - "actor_id", - "old_permission", - "_document_id", - "programmatic_access_type" + "old_permission" ] }, { @@ -7977,20 +12089,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -7998,17 +12121,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -8018,41 +12154,65 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, { "action": "org.update_saml_provider_settings", - "description": "An organization's SAML provider settings were updated.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "sso_url", - "actor_id", - "operation_type", + "description": "An organization's SAML provider settings were updated.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "issuer", - "org", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "operation_type", + "issuer", + "created_at" ] }, { @@ -8060,18 +12220,30 @@ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", "fields": [ - "request_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "_document_id", - "org", - "action", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" }, @@ -8080,20 +12252,33 @@ "description": "A domain was approved for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "org_id", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" }, @@ -8102,16 +12287,31 @@ "description": "A domain was added to an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "created_at", + "@timestamp", "_document_id", - "domain_name", "action", - "request_id", + "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "domain_name", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8120,14 +12320,29 @@ "description": "A domain was removed from an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", "fields": [ - "action", - "domain_name", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "domain_name", "operation_type", "created_at" ], @@ -8138,16 +12353,31 @@ "description": "A domain was verified for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "operation_type", - "domain_name", "@timestamp", - "user_agent", - "request_id", - "actor", - "action", - "created_at", "_document_id", - "actor_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "domain_name", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8156,20 +12386,31 @@ "description": "An entire package was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" @@ -8179,23 +12420,34 @@ "description": "A package was published or republished to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "ecosystem", "version_count", "is_republished", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -8204,21 +12456,32 @@ "description": "A specific package version was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "version", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "ecosystem", "actor_is_bot" ], @@ -8229,21 +12492,34 @@ "description": "A specific package version was published or republished to a package.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "ecosystem", "package", "version", - "actor_id", - "user_agent", "is_republished", - "actor", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -8252,20 +12528,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -8274,17 +12564,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8295,20 +12600,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -8317,19 +12636,31 @@ "description": "A new passkey was added.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8337,19 +12668,31 @@ "description": "A new passkey was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8357,18 +12700,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8376,16 +12731,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8393,18 +12762,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8412,18 +12793,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8434,18 +12828,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8456,17 +12863,30 @@ "description": "Triggered when you create a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8476,19 +12896,31 @@ "description": "Triggered when you regenerate a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8496,12 +12928,29 @@ "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", "fields": [ - "user_programmatic_access_name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", "operation_type" ], @@ -8512,20 +12961,32 @@ "description": "Triggered when you delete a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "explanation", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8533,17 +12994,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8554,18 +13028,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8577,17 +13064,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8599,17 +13099,30 @@ "description": "A fine-grained personal access token was updated.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8620,15 +13133,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8638,17 +13166,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8658,15 +13197,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8676,17 +13230,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8696,17 +13261,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8716,17 +13292,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8736,17 +13323,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8756,17 +13354,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -8776,17 +13387,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8794,20 +13418,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -8817,25 +13452,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -8843,20 +13490,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8864,25 +13523,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8890,17 +13561,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -8908,17 +13592,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -8926,18 +13623,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -8946,18 +13655,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -8966,19 +13687,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -8986,17 +13718,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -9008,22 +13753,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -9031,19 +13785,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -9051,17 +13816,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9069,18 +13847,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -9088,20 +13879,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9109,18 +13910,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -9129,18 +13942,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -9149,16 +13974,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -9170,21 +14008,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -9192,22 +14042,32 @@ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", "fields": [ - "repo", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "name", "created_at", - "_document_id", "operation_type", - "actor", - "repo_id", - "org", - "request_id", - "actor_id", - "oauth_application_id", - "@timestamp", - "programmatic_access_type" + "oauth_application_id" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" }, @@ -9216,29 +14076,34 @@ "description": "A protected branch allowance was given to a specific user, team or integration.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "authorized_actors", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -9246,24 +14111,32 @@ "description": "Branch protection was enabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", "user_agent", - "repo", + "operation_type", "name", - "org_id", - "user", - "_document_id", - "request_id", - "actor", - "actor_id", - "org", - "action", "created_at", "authorized_actor_names", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -9274,21 +14147,31 @@ "description": "Branch protection was disabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "repo", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", - "request_id", - "repo_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "name", + "operation_type", "created_at", - "_document_id", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -9299,22 +14182,32 @@ "description": "Enforcement of dismissing stale pull requests was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "dismiss_stale_reviews_on_push", - "org_id", - "action", - "created_at", - "request_id", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismiss_stale_reviews_on_push", + "created_at", "operation_type", - "actor", - "repo", - "org", - "name", - "programmatic_access_type" + "name" ] }, { @@ -9322,24 +14215,34 @@ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "authorized_actors_only", "authorized_actors", "created_at", - "user_agent", "name", - "_document_id", - "org_id", - "request_id", - "@timestamp", - "actor_id", - "org", - "action", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -9347,30 +14250,37 @@ "description": "A branch protection requirement was overridden by a repository administrator.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "actor", "reasons", - "@timestamp", "before", "after", - "actor_id", - "repo", "operation_type", - "user_agent", "branch", "overridden_codes", - "org", - "org_id", - "action", - "_document_id", - "request_id", "referrer", - "business", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "rule_suite_id" ] @@ -9380,28 +14290,36 @@ "description": "A branch update attempt was rejected.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "request_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "branch", "before", "overridden_codes", "after", - "action", "reasons", - "actor_id", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "actor_is_bot", "rule_suite_id" @@ -9412,23 +14330,32 @@ "description": "Branch protection was enforced for repository administrators.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "admin_enforced", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "name", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "action", "repo_id", - "org_id", - "_document_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "admin_enforced", + "operation_type", + "name", + "created_at" ] }, { @@ -9436,22 +14363,32 @@ "description": "Branch deletion was enabled or disabled for a protected branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "operation_type", - "request_id", - "repo", "@timestamp", - "org_id", - "org", - "action", - "allow_deletions_enforcement_level", "_document_id", - "created_at", - "actor_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_deletions_enforcement_level", + "created_at" ] }, { @@ -9459,23 +14396,32 @@ "description": "Force pushes were enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "_document_id", - "actor", - "repo", "operation_type", - "request_id", "allow_force_pushes_enforcement_level", - "@timestamp", - "org", - "action", - "created_at", - "user_agent", - "repo_id", - "token_scopes", - "programmatic_access_type" + "created_at" ] }, { @@ -9483,24 +14429,33 @@ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "ignore_approvals_from_contributors", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -9509,22 +14464,32 @@ "description": "Required linear commit history was enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "operation_type", "actor", - "linear_history_requirement_enforcement_level", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "linear_history_requirement_enforcement_level", "name", - "org_id", - "repo_id", - "org", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ] }, { @@ -9532,24 +14497,33 @@ "description": "Fork syncing was enabled or disabled for a read-only branch", "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "lock_allows_fetch_and_merge", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -9558,27 +14532,34 @@ "description": "The enforcement of a branch lock was updated.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "enforcement_level", "lock_branch_enforcement_level", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -9587,18 +14568,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9609,24 +14603,33 @@ "description": "A branch name pattern was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "old_name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "old_name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -9634,25 +14637,32 @@ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", "docs_reference_links": "N/A", "fields": [ - "name", - "org_id", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "@timestamp", + "business", "business_id", - "request_id", - "pull_request_reviews_enforcement_level", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "business", - "user_agent", - "created_at", "repo_id", - "operation_type", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "pull_request_reviews_enforcement_level", + "created_at", + "operation_type" ] }, { @@ -9660,22 +14670,32 @@ "description": "Enforcement of required code owner review was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "created_at", - "require_code_owner_review", - "operation_type", - "name", - "user_agent", - "action", "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "request_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "require_code_owner_review", + "operation_type", + "name" ] }, { @@ -9683,22 +14703,33 @@ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "require_last_push_approval", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" }, @@ -9707,22 +14738,32 @@ "description": "Enforcement of the required number of approvals before merging was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "required_approving_review_count", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "required_approving_review_count", "created_at", - "actor", "operation_type", - "user_agent", - "name", - "org_id", - "action", - "actor_id", - "_document_id", - "org", - "@timestamp", - "programmatic_access_type" + "name" ] }, { @@ -9730,25 +14771,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "user_agent", "@timestamp", "_document_id", - "name", - "repo", "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "business", - "actor_id", - "operation_type", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "required_status_checks_enforcement_level", - "org", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "required_status_checks_enforcement_level" ] }, { @@ -9756,22 +14804,32 @@ "description": "Enforcement of required commit signing was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "name", "@timestamp", - "created_at", "_document_id", - "request_id", - "repo_id", - "org", - "org_id", "action", "actor", "actor_id", - "signature_requirement_enforcement_level", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "programmatic_access_type" + "operation_type", + "name", + "created_at", + "signature_requirement_enforcement_level" ] }, { @@ -9779,22 +14837,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "created_at", - "repo_id", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "name", - "actor", - "repo", "operation_type", - "action", - "strict_required_status_checks_policy", - "programmatic_access_type" + "strict_required_status_checks_policy" ] }, { @@ -9802,23 +14870,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -9827,24 +14906,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -9853,20 +14943,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -9875,21 +14979,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "_document_id", "title", - "request_id", "key", - "action", - "actor", "read_only", "explanation", - "repo_id", - "@timestamp", - "actor_id", - "repo", - "user_agent", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -9899,22 +15016,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -9923,25 +15052,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -9950,23 +15089,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", "key", "fingerprint", - "actor_id", - "actor", "title", - "user_agent", - "user_id", - "request_id", - "read_only", - "token_scopes", - "programmatic_access_type" + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -9975,18 +15125,32 @@ "description": "A pull request was closed without being merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" @@ -9996,21 +15160,32 @@ "description": "A pull request was converted to a draft.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" }, @@ -10019,19 +15194,32 @@ "description": "A pull request was created.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -10042,23 +15230,35 @@ "description": "A review was requested on a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -10068,17 +15268,31 @@ "description": "A pull request was marked as in progress.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -10086,19 +15300,32 @@ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -10106,19 +15333,32 @@ "description": "A pull request was merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" @@ -10128,21 +15368,32 @@ "description": "A pull request was marked as ready for review.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" }, @@ -10151,27 +15402,34 @@ "description": "A pull request was rebased.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "pull_request_url", "pull_request_title", - "user", - "user_id", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -10179,23 +15437,35 @@ "description": "A review request was removed from a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" }, @@ -10204,18 +15474,32 @@ "description": "A pull request was reopened after previously being closed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -10223,19 +15507,31 @@ "description": "A review comment was added to a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "comment_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -10245,20 +15541,31 @@ "description": "A review comment on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", "@timestamp", "_document_id", - "repo", - "created_at", - "request_id", - "comment_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "comment_id", + "operation_type" ] }, { @@ -10266,40 +15573,65 @@ "description": "A review comment on a pull request was changed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "request_id", - "actor_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "comment_id" + ] + }, + { + "action": "pull_request_review.delete", + "description": "A review on a pull request was deleted.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "comment_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" - ] - }, - { - "action": "pull_request_review.delete", - "description": "A review on a pull request was deleted.", - "docs_reference_links": "N/A", - "fields": [ + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ] }, { @@ -10307,20 +15639,33 @@ "description": "A review on a pull request was dismissed.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" }, @@ -10329,19 +15674,33 @@ "description": "A review on a pull request was submitted.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" @@ -10351,22 +15710,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -10375,21 +15744,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -10398,25 +15776,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -10425,23 +15810,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -10450,24 +15843,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -10476,23 +15876,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -10502,22 +15910,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -10526,19 +15943,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -10547,24 +15977,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -10573,24 +16013,32 @@ "description": "Autofix for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -10598,24 +16046,32 @@ "description": "Autofix for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -10623,23 +16079,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -10650,25 +16115,31 @@ "description": "Code scanning using the default setup was disabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -10677,26 +16148,34 @@ "description": "Code scanning using the default setup was enabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "query_suite", "threat_model", - "languages", - "request_access_security_header" + "languages" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -10705,25 +16184,34 @@ "description": "Code scanning using the default setup was updated for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "query_suite", "threat_model", "languages", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Configuring default setup for code scanning" @@ -10733,20 +16221,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "visibility", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -10754,17 +16253,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -10773,15 +16285,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -10792,16 +16317,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -10811,17 +16349,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -10831,19 +16382,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -10852,17 +16414,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -10871,26 +16446,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -10899,30 +16480,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -10932,20 +16518,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -10954,25 +16551,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -10981,23 +16586,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -11005,25 +16621,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -11033,17 +16658,30 @@ "description": "A repository was archived on disk.", "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories", "fields": [ - "actor_id", - "repo", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", - "repo_id", - "actor", "action", - "user_agent" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/archiving-a-github-repository/archiving-repositories" }, @@ -11052,23 +16690,32 @@ "description": "A source code archive of a repository was downloaded as a ZIP file.", "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "created_at", "operation_type", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" @@ -11078,20 +16725,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "visibility", - "repo_id", - "created_at", - "actor", - "action", - "@timestamp", "org_id", - "request_id", + "programmatic_access_type", "repo", - "_document_id" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "visibility", + "created_at" ] }, { @@ -11099,20 +16757,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "visibility", - "repo_id", - "request_id", - "action", - "_document_id", "@timestamp", - "actor_id", - "created_at", - "user", - "operation_type", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", "public_repo" ] }, @@ -11121,19 +16790,30 @@ "description": "The repository was unlocked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11141,20 +16821,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "action", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "operation_type", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "visibility", - "actor", - "user_id" + "visibility" ] }, { @@ -11162,23 +16853,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -11186,21 +16887,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -11208,21 +16919,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -11230,22 +16951,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -11253,21 +16983,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -11275,20 +17015,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11296,22 +17047,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -11319,18 +17079,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -11338,22 +17112,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -11361,21 +17145,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -11383,18 +17177,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -11403,22 +17209,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -11427,24 +17242,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -11453,23 +17276,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -11477,26 +17310,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -11505,21 +17343,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -11528,25 +17375,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -11554,22 +17407,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -11578,20 +17441,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "visibility", - "operation_type", - "repo", + "@timestamp", "_document_id", - "user", - "user_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "@timestamp", - "request_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -11599,19 +17473,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -11619,17 +17504,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -11638,17 +17538,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -11657,7 +17572,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -11672,23 +17608,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -11698,20 +17643,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -11722,21 +17678,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -11745,22 +17712,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ - "actor", - "actor_id", - "user_agent", - "request_id", - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -11769,21 +17746,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -11792,22 +17780,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -11818,16 +17816,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -11836,22 +17845,31 @@ "description": "Temporary access was enabled for a repository.", "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing user-owned repositories in your enterprise" }, @@ -11861,22 +17879,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -11885,23 +17914,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -11911,19 +17950,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -11931,21 +17980,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -11954,24 +18013,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "old_policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", + "old_policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -11979,25 +18047,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12006,24 +18081,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12032,25 +18117,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12059,22 +18152,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12083,26 +18185,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -12110,31 +18220,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12143,24 +18260,30 @@ "description": "Branch protections were disabled for the repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -12169,24 +18292,30 @@ "description": "Branch protections were enabled for this repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -12195,21 +18324,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "content_type", - "repo", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -12217,21 +18356,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -12239,21 +18388,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -12261,20 +18421,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -12282,21 +18454,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -12304,19 +18487,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -12324,31 +18520,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -12357,19 +18561,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -12377,8 +18592,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -12387,23 +18601,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -12428,26 +18651,32 @@ "description": "Automatic partner validation checks have been disabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -12456,26 +18685,32 @@ "description": "Automatic partner validation checks have been enabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -12484,23 +18719,30 @@ "description": "A custom pattern was created for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12510,23 +18752,30 @@ "description": "A custom pattern was removed from secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12536,24 +18785,31 @@ "description": "A custom pattern was published for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12563,24 +18819,31 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -12589,24 +18852,31 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12616,23 +18886,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12642,23 +18919,31 @@ "description": "Secret scanning was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "public_repo", - "programmatic_access_type" + "public_repo" ], "docs_reference_titles": "About secret scanning" }, @@ -12667,22 +18952,30 @@ "description": "Secret scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -12690,24 +18983,32 @@ "description": "Secret scanning for non-provider patterns was disabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -12716,24 +19017,32 @@ "description": "Secret scanning for non-provider patterns was enabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -12742,19 +19051,31 @@ "description": "A role or team was added to the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -12763,24 +19084,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -12789,24 +19118,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -12815,19 +19152,31 @@ "description": "A role or team was removed from the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -12836,26 +19185,31 @@ "description": "Secret scanning push protection was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -12864,26 +19218,31 @@ "description": "Secret scanning push protection was enabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -12892,18 +19251,31 @@ "description": "Email notification restrictions for an organization or enterprise were disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -12912,19 +19284,31 @@ "description": "Email notification restrictions for an organization or enterprise were enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -12933,14 +19317,28 @@ "description": "GitHub detected a secret and created a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -12954,22 +19352,32 @@ "description": "A secret scanning alert was reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type_display_name" ] }, @@ -12978,28 +19386,37 @@ "description": "A secret scanning alert was resolved.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "resolution", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", + "resolution", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type", "secret_type_display_name", "publicly_leaked", - "multi_repo", - "request_access_security_header" + "multi_repo" ] }, { @@ -13007,25 +19424,32 @@ "description": "A secret scanning alert was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -13033,14 +19457,28 @@ "description": "A secret scanning alert was validated.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "previous_validity", @@ -13057,19 +19495,30 @@ "description": "Secret scanning was disabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -13078,19 +19527,30 @@ "description": "Secret scanning was enabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -13099,20 +19559,30 @@ "description": "Secret scanning was disabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -13121,19 +19591,30 @@ "description": "Secret scanning was enabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -13142,14 +19623,28 @@ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "push_protection_bypass_reason", @@ -13167,25 +19662,33 @@ "description": "A request to bypass secret scanning push protection was approved by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -13194,25 +19697,33 @@ "description": "A request to bypass secret scanning push protection was denied by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", - "request_access_security_header", "request_reviewer_comment" ], "docs_reference_titles": "About push protection" @@ -13222,25 +19733,33 @@ "description": "A user requested to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" }, @@ -13249,18 +19768,30 @@ "description": "A security key was registered for an account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "created_at", - "user_id", - "action", - "operation_type", - "request_id", "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -13268,18 +19799,30 @@ "description": "A security key was removed from an account.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "operation_type", - "_document_id", - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13287,16 +19830,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -13306,18 +19862,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -13326,16 +19895,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -13346,15 +19928,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -13364,15 +19959,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -13381,17 +19991,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -13400,17 +20023,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -13419,16 +20056,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -13438,14 +20088,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -13455,17 +20120,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -13474,17 +20152,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -13493,18 +20184,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -13513,15 +20217,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -13531,16 +20249,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13548,15 +20279,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -13567,16 +20311,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -13586,17 +20343,30 @@ "description": "Triggered when you send an email update to your sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", "fields": [ - "request_id", - "actor", - "action", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" }, @@ -13605,17 +20375,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -13626,17 +20409,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -13647,18 +20443,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -13668,16 +20475,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -13687,17 +20507,30 @@ "description": "You join the waitlist to join GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "actor_id", - "action", "operation_type", - "created_at", - "user", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -13706,16 +20539,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -13727,17 +20573,30 @@ "fields": [ "@timestamp", "_document_id", - "fingerprint", - "operation_type", - "openssh_public_key", - "org_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "request_id" + "fingerprint", + "operation_type", + "openssh_public_key", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -13746,19 +20605,32 @@ "description": "An SSH certificate authority for an organization or enterprise was deleted.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "created_at", + "@timestamp", "_document_id", - "fingerprint", - "operation_type", + "action", "actor", - "org_id", - "openssh_public_key", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", - "request_id" + "created_at", + "fingerprint", + "operation_type", + "openssh_public_key" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -13767,21 +20639,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "user", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "request_id", - "org", - "org_id", - "created_at", - "actor", "action", - "user_id", + "actor", + "actor_id", "business", "business_id", - "@timestamp", - "actor_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -13790,19 +20671,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "actor_id", - "user_id", - "org", - "operation_type", - "request_id", "@timestamp", "_document_id", - "actor", - "user", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -13811,20 +20703,34 @@ "description": "The verification code expiry time for an organization or enterprise domain was set.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "token_expires_at", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -13832,18 +20738,33 @@ "description": "An organization or enterprise domain was unverified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ] }, { @@ -13851,16 +20772,31 @@ "description": "An organization or enterprise domain was verified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "domain_name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -13868,23 +20804,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13892,23 +20838,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13916,23 +20872,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13940,23 +20906,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13964,15 +20940,30 @@ "description": "Triggered when you accept a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -13981,15 +20972,30 @@ "description": "Triggered when you cancel a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -13998,15 +21004,30 @@ "description": "Triggered when you create a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -14015,15 +21036,30 @@ "description": "Triggered when you decline a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -14032,15 +21068,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14048,15 +21099,30 @@ "description": "Triggered when you revoke a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -14065,21 +21131,31 @@ "description": "A member of an organization was added to a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", "fields": [ - "user_agent", - "request_id", - "org_id", - "user_id", - "team", - "user", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type", - "_document_id", - "org", - "action", - "actor", - "programmatic_access_type", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" @@ -14089,22 +21165,31 @@ "description": "A team was given access and permissions to a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "team", - "action", - "operation_type", - "request_id", - "created_at", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "actor_id", - "_document_id", "repo_id", - "user_agent", - "org_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -14113,20 +21198,31 @@ "description": "A child team was created or a child team's parent was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", "fields": [ - "org", "@timestamp", - "created_at", "_document_id", - "team", "action", - "operation_type", "actor", - "request_id", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", + "operation_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" }, @@ -14135,18 +21231,31 @@ "description": "A team's privacy level was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", "fields": [ - "user_agent", - "request_id", - "org", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", "created_at", "operation_type", - "actor_id", - "org_id", - "@timestamp", - "actor", - "_document_id", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" @@ -14156,21 +21265,32 @@ "description": "A new team is created.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "oauth_application_id", + "operation_type", "team", - "org", - "actor", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "team_type" ] }, @@ -14179,21 +21299,31 @@ "description": "A user was demoted from a team maintainer to a team member.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" }, @@ -14202,19 +21332,31 @@ "description": "A team was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "team", "org_id", - "actor_id", - "actor", - "action", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", "operation_type", - "_document_id", - "programmatic_access_type", "team_type" ] }, @@ -14223,19 +21365,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "business_id", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", "actor_id", - "user", "business", - "action", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14243,19 +21396,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "operation_type", - "request_id", "actor", - "org", - "created_at", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", - "_document_id" + "operation_type", + "created_at" ] }, { @@ -14263,18 +21427,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", "@timestamp", - "action", "_document_id", - "user_agent", - "user_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business", + "user_id", + "user_agent", "operation_type", - "actor", "created_at" ] }, @@ -14283,22 +21458,31 @@ "description": "A user was promoted from a team member to a team maintainer.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" }, @@ -14307,22 +21491,31 @@ "description": "An organization member was removed from a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", "fields": [ - "request_id", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "team", - "user_id", - "actor", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", + "user_id", "user_agent", - "_document_id", - "token_scopes", - "programmatic_access_type", + "operation_type", + "created_at", + "team", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" @@ -14332,21 +21525,31 @@ "description": "A repository was removed from a team's control.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "org_id", - "repo", - "repo_id", - "action", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "created_at", "team", - "org", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -14354,21 +21557,32 @@ "description": "A team's name was changed.", "docs_reference_links": "N/A", "fields": [ - "name", - "user_agent", - "created_at", - "team", - "operation_type", - "actor_id", - "org", + "@timestamp", + "_document_id", "action", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "_document_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "team", + "operation_type", "team_type" ] }, @@ -14377,17 +21591,30 @@ "description": "Team synchronization with a tenant was disabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "request_id", - "org_id", "actor_id", - "operation_type", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -14396,19 +21623,30 @@ "description": "Team synchronization with a tenant was enabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ - "org_id", - "business_id", - "actor", - "created_at", - "user_agent", "@timestamp", - "operation_type", - "business", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -14417,28 +21655,37 @@ "description": "A team's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "team", - "org_id", "@timestamp", - "org", "_document_id", - "old_permission", - "request_id", - "repo", "action", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "old_permission", "operation_type", "created_at", - "user_agent", "permission", "new_repo_permission", "new_repo_base_role", "old_repo_permission", - "old_repo_base_role", - "token_scopes", - "programmatic_access_type" + "old_repo_base_role" ] }, { @@ -14446,17 +21693,30 @@ "description": "A new trusted device was added.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14464,17 +21724,30 @@ "description": "A trusted device was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14482,14 +21755,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "action", - "request_id", - "user_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -14498,15 +21786,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "created_at", - "user_id", - "operation_type", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action" + "created_at", + "operation_type" ] }, { @@ -14514,13 +21817,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "created_at", - "user_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14528,17 +21848,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "operation_type", - "action", - "_document_id" + "created_at", + "operation_type" ] }, { @@ -14546,17 +21879,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user", - "created_at", - "request_id", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -14564,16 +21910,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14581,15 +21941,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_id", - "action", "@timestamp", - "created_at", - "user_agent", - "user", "_document_id", - "request_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14597,18 +21972,30 @@ "description": "A secondary authentication factor was added to a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -14617,18 +22004,30 @@ "description": "Two-factor authentication was disabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", "fields": [ - "actor", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor_id", + "user_agent", "created_at", - "operation_type", - "request_id", - "@timestamp", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Disabling two-factor authentication for your personal account" }, @@ -14637,18 +22036,30 @@ "description": "Two-factor authentication was enabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ - "actor", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Configuring two-factor authentication" }, @@ -14657,15 +22068,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "@timestamp", - "request_id", - "_document_id", - "user_agent" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14673,16 +22099,29 @@ "description": "Two factor recovery codes were regenerated for a user account.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", + "operation_type", "created_at" ] }, @@ -14691,18 +22130,30 @@ "description": "A secondary authentication factor was removed from a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -14711,15 +22162,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "created_at", - "_document_id", - "action", - "@timestamp" + "operation_type", + "created_at" ] }, { @@ -14728,16 +22194,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "operation_type", "user_agent", - "action", - "request_id", - "actor", - "actor_id" + "created_at", + "operation_type" ] }, { @@ -14745,19 +22224,31 @@ "description": "An email address was added to a user account.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", "operation_type", - "_document_id", - "actor_id", - "actor", "email", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding an email address to your GitHub account" }, @@ -14766,18 +22257,30 @@ "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "created_at", - "user", "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -14785,15 +22288,28 @@ "description": "Audit log entries were exported.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "action", - "request_id", - "actor", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", "created_at" ] @@ -14803,20 +22319,31 @@ "description": "A user was blocked by another user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_id", - "_document_id", "actor_id", - "@timestamp", - "user_agent", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -14824,18 +22351,30 @@ "description": "A user changed their password.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "actor_id", - "operation_type", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "created_at", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14843,18 +22382,30 @@ "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -14863,17 +22414,30 @@ "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -14882,16 +22446,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "user_agent", - "created_at", - "user", "action", - "operation_type", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14899,16 +22477,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "_document_id", "@timestamp", - "created_at", - "user_agent", - "operation_type", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14916,16 +22508,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "created_at", - "_document_id", - "user_agent", - "user_id", "@timestamp", - "user", + "_document_id", "action", - "request_access_security_header" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14933,19 +22539,31 @@ "description": "A new user account was created.", "docs_reference_links": "N/A", "fields": [ - "email", - "user_id", - "operation_type", "@timestamp", - "request_id", - "user", - "created_at", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "action", - "programmatic_access_type" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "email", + "operation_type", + "created_at" ] }, { @@ -14953,21 +22571,33 @@ "description": "A user secret for Codespaces was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -14975,20 +22605,31 @@ "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "user_agent", + "@timestamp", "_document_id", - "operation_type", - "oauth_application_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "@timestamp", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -14996,18 +22637,30 @@ "description": "A user account was destroyed by an asynchronous job.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "request_id", - "user_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15016,19 +22669,30 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "oauth_application_id", + "_document_id", "action", - "user", - "created_at", - "user_agent", - "request_id", "actor", "actor_id", - "operation_type", - "_document_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", + "operation_type" ] }, { @@ -15036,18 +22700,30 @@ "description": "A user deleted his or her account, triggering user.async_delete.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "_document_id", - "created_at", - "user_agent", "user_id", - "operation_type", - "actor_id", - "action", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -15055,18 +22731,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "user_agent", "user_id", - "actor_id", - "action", - "operation_type", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -15074,18 +22762,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "operation_type", - "created_at", - "_document_id", - "@timestamp", - "user", - "actor_id", - "action", - "request_access_security_header" + "created_at" ] }, { @@ -15094,17 +22794,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user", "_document_id", "action", - "operation_type", - "user_agent", - "created_at", - "request_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15112,17 +22824,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15130,17 +22855,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15148,17 +22886,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15166,21 +22917,31 @@ "description": "An enterprise managed user claimed an email address.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15188,21 +22949,31 @@ "description": "N/A", "docs_reference_links": "An enterprise managed user unclaimed an email address.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." }, @@ -15211,17 +22982,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15229,17 +23013,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15247,17 +23044,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15265,18 +23075,30 @@ "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "action", - "operation_type", - "request_id", - "created_at", - "_document_id", "@timestamp", - "user", - "org_id", + "_document_id", + "action", "actor", "actor_id", - "user_agent" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15284,16 +23106,29 @@ "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", "user_agent", + "operation_type", "created_at" ] }, @@ -15302,17 +23137,31 @@ "description": "A user requested a password reset.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", "fields": [ - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "email", - "created_at", - "user_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" }, @@ -15321,17 +23170,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "created_at", - "user_agent", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor", - "operation_type", - "request_id" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -15339,18 +23201,30 @@ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -15359,19 +23233,31 @@ "description": "A user signed in.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "actor_id", "@timestamp", - "user", - "action", - "operation_type", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "actor", - "passkey_nickname", - "request_access_security_header" + "passkey_nickname" ] }, { @@ -15379,18 +23265,30 @@ "description": "A user signed out.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -15398,38 +23296,61 @@ "description": "A comment made by a user was minimized.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", - "actor_id", "@timestamp", - "created_at", - "operation_type", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "user.new_device_used", + "description": "A user signed in from a new device.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" - ] - }, - { - "action": "user.new_device_used", - "description": "A user signed in from a new device.", - "docs_reference_links": "N/A", - "fields": [ "user", "user_id", - "actor", - "operation_type", - "created_at", "user_agent", - "actor_id", - "action", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -15437,14 +23358,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", "_document_id", "action", - "@timestamp", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15452,21 +23389,31 @@ "description": "An ordinary user account was promoted to a site administrator.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", + "user_id", "user_agent", + "created_at", "oauth_application_id", - "request_id", - "operation_type", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -15474,16 +23421,29 @@ "description": "A user's account was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user", - "action", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "actor", "operation_type" ] }, @@ -15492,20 +23452,31 @@ "description": "An email address was removed from a user account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "actor", - "actor_id", "created_at", - "email", - "token_scopes", - "programmatic_access_type" + "email" ] }, { @@ -15513,20 +23484,32 @@ "description": "A user secret for Codespaces was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "key", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "key", + "integration", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -15534,17 +23517,30 @@ "description": "A user account was no longer flagged as a large scale contributor.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15552,20 +23548,31 @@ "description": "A username was changed.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "request_id", - "actor_id", - "old_login", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "operation_type", "user_agent", - "token_scopes", - "programmatic_access_type" + "old_login", + "created_at", + "operation_type" ] }, { @@ -15573,17 +23580,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "user_agent", - "request_id", - "action", "@timestamp", - "created_at", - "org_id", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -15592,18 +23611,30 @@ "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "action", "created_at", - "actor", - "operation_type", - "actor_id", - "user_id", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam" }, @@ -15612,18 +23643,30 @@ "description": "A user reset their account password.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "@timestamp", - "_document_id", - "actor", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -15631,16 +23674,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_id", - "action", "@timestamp", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -15651,16 +23707,28 @@ "fields": [ "@timestamp", "_document_id", - "request_id", - "user_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor_id", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -15669,18 +23737,30 @@ "description": "A user signed in from an unrecognized device.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "created_at", - "actor", - "actor_id", - "@timestamp", - "request_access_security_header" + "created_at" ] }, { @@ -15688,18 +23768,30 @@ "description": "A user signed in from an unrecognized device and location.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "created_at", - "_document_id", - "request_id", - "action", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -15707,18 +23799,30 @@ "description": "A user signed in from an unrecognized location.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "action", - "operation_type", - "user_agent", - "user", + "@timestamp", "_document_id", + "action", "actor", - "created_at", "actor_id", - "@timestamp", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15726,22 +23830,33 @@ "description": "Triggered when you clear the status on your profile.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "message", - "user", - "actor_id", "created_at", - "request_id", "limited_availability", - "action", "emoji", - "operation_type", - "user_agent", - "@timestamp", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -15749,23 +23864,33 @@ "description": "Triggered when you set or change the status on your profile.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", "fields": [ - "limited_availability", - "user", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "message", - "user_id", - "created_at", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "limited_availability", + "message", + "created_at", "emoji", - "org", - "actor", - "operation_type", - "token_scopes", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Personalize your profile" }, @@ -15774,21 +23899,31 @@ "description": "A user account was suspended.", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", - "operation_type", - "actor_id", - "user", - "user_agent", - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", - "user_id", + "_document_id", "action", - "token_scopes", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -15796,18 +23931,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "actor_id", - "@timestamp", - "operation_type", - "_document_id", - "user_agent", - "actor", - "action", "user_id", - "created_at", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15815,18 +23962,30 @@ "description": "A 2FA challenge issued for a user account failed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "_document_id", - "user_agent", - "user", - "actor_id", - "actor", - "user_id", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15836,16 +23995,28 @@ "fields": [ "@timestamp", "_document_id", - "user_id", - "operation_type", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "actor", + "user_id", "user_agent", - "request_id", - "action", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -15853,18 +24024,30 @@ "description": "A user used their 2FA recovery codes.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "user_agent", - "request_id", - "user", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "created_at", - "@timestamp", - "_document_id", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15872,18 +24055,30 @@ "description": "A user downloaded 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -15891,17 +24086,30 @@ "description": "A user printed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", - "user_agent", - "request_id", - "user_id", - "created_at", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15909,18 +24117,30 @@ "description": "A user viewed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", "created_at", - "user", - "operation_type", - "@timestamp", - "request_id", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -15928,17 +24148,30 @@ "description": "A user was prompted for a two-factor authentication code.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", "fields": [ - "user", - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "actor" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" }, @@ -15947,19 +24180,31 @@ "description": "A user was unblocked by another user.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "actor", - "@timestamp", - "user_agent", - "user_id", - "user", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -15968,15 +24213,28 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user_agent", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "request_id", - "actor", - "action", "created_at" ] }, @@ -15985,21 +24243,31 @@ "description": "A user account was unsuspended.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", - "user", "action", - "user_agent", "actor", - "oauth_application_id", - "operation_type", "actor_id", - "created_at", - "@timestamp", - "user_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -16007,21 +24275,33 @@ "description": "A user secret for Codespaces was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -16029,18 +24309,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16048,27 +24340,33 @@ "description": "A workflow job was approved.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", - "repo", - "repo_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -16077,23 +24375,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -16101,10 +24409,28 @@ "description": "A workflow run was cancelled.", "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -16115,20 +24441,9 @@ "run_number", "cancelled_at", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Canceling a workflow run" }, @@ -16137,23 +24452,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16163,10 +24486,28 @@ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -16178,19 +24519,9 @@ "conclusion", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -16201,10 +24532,28 @@ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -16213,21 +24562,10 @@ "head_branch", "head_sha", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "public_repo", - "programmatic_access_type", "actor_is_bot", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "Understanding GitHub Actions" @@ -16237,23 +24575,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -16262,22 +24612,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16285,21 +24646,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -16307,25 +24679,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16333,23 +24713,36 @@ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", "fields": [ - "repo_id", - "repo", - "org_id", - "org", - "business_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "job_name", "runner_labels", "is_hosted_runner", "environment_name", "secrets_passed", - "action", - "_document_id", "operation_type", "created_at", - "@timestamp", "runner_owner_type", "job_workflow_ref", "calling_workflow_refs", @@ -16363,24 +24756,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -16389,10 +24791,28 @@ "description": "A workflow run was re-run.", "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -16402,21 +24822,11 @@ "head_sha", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", "rerun_type", "check_run_id", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "Re-running workflows and jobs" @@ -16426,25 +24836,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.15/organization.json b/src/audit-logs/data/ghes-3.15/organization.json index 6c8b68aaf806..d9be92aea738 100644 --- a/src/audit-logs/data/ghes-3.15/organization.json +++ b/src/audit-logs/data/ghes-3.15/organization.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,29 +67,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -72,21 +103,32 @@ "description": "Credit was accepted for a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Editing a repository security advisory" }, @@ -95,21 +137,32 @@ "description": "Someone was added to the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -117,21 +170,32 @@ "description": "Credit was declined for a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -140,21 +204,32 @@ "description": "Someone was removed from the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -163,18 +238,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -182,17 +269,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -203,39 +301,62 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" - }, + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -244,19 +365,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -265,18 +398,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -284,18 +430,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -303,20 +461,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -325,20 +494,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -349,17 +529,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -367,14 +559,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -384,28 +591,34 @@ "description": "An attempt to create a codespace from a prebuild was made.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "owner", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "user_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_id", + "user_agent", + "name", + "owner", + "pull_request_id", "created_at", "operation_type", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -413,17 +626,30 @@ "description": "Enterprise setting for Codespaces ownership was updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enablement", "organization_names", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -434,25 +660,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -463,22 +698,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -490,22 +736,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -514,15 +771,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -533,15 +805,28 @@ "description": "Policies were applied to codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -551,20 +836,30 @@ "description": "Policies were removed from codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -572,19 +867,30 @@ "description": "Policies were updated for codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -592,17 +898,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -612,27 +931,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", "org", - "owner", - "pull_request_id", - "machine_type", - "user_id", - "user", - "devcontainer_path", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "owner", + "pull_request_id", + "machine_type", + "devcontainer_path", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -640,19 +968,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -660,18 +1001,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -680,20 +1033,30 @@ "description": "A commit comment was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "repo", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "created_at", - "@timestamp", - "operation_type", + "programmatic_access_type", + "repo", "repo_id", - "actor_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "programmatic_access_type" + "created_at", + "operation_type" ] }, { @@ -701,21 +1064,30 @@ "description": "A commit comment was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "repo_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_id", - "action", - "@timestamp", - "repo", "org_id", - "actor_id", - "created_at", - "user_agent", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -723,21 +1095,33 @@ "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "reason", "plan", - "org_id", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -745,13 +1129,28 @@ "description": "Copilot feature settings were changed at the organization level.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -761,23 +1160,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -785,16 +1191,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -803,40 +1223,59 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "request_access_security_header" - ] - }, - { - "action": "copilot.cfb_seat_assignment_reused", - "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", - "docs_reference_links": "N/A", - "fields": [ - "actor", - "actor_id", - "user_agent", - "request_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "copilot.cfb_seat_assignment_reused", + "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -846,20 +1285,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -867,19 +1316,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -887,21 +1348,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -909,21 +1379,33 @@ "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_value", "new_value", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -931,21 +1413,32 @@ "description": "The excluded paths for GitHub Copilot were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "excluded_paths", "owner_type", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -953,21 +1446,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -975,21 +1478,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -997,21 +1510,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1019,17 +1542,30 @@ "description": "The plan for GitHub Copilot was updated.", "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_plan", "plan", - "business_id", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1041,20 +1577,31 @@ "description": "The plan for GitHub Copilot was scheduled to be downgraded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "current_plan", "scheduled_plan" @@ -1065,21 +1612,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "name", - "runner_group_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1089,19 +1645,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1111,21 +1676,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1135,18 +1709,31 @@ "description": "A new custom property definition was created.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -1159,18 +1746,31 @@ "description": "A custom property definition was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -1184,14 +1784,29 @@ "description": "A custom property definition was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "value_type", @@ -1204,8 +1819,7 @@ "old_default_value", "old_value_type", "old_values_editable_by", - "values_editable_by", - "request_access_security_header" + "values_editable_by" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1214,27 +1828,35 @@ "description": "A repository's custom property value was manually set for the first time.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1243,19 +1865,31 @@ "description": "A repository's custom property value was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1264,16 +1898,29 @@ "description": "A repository's custom property value was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "definition_id" @@ -1285,19 +1932,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1306,19 +1964,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1327,19 +1996,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1348,19 +2028,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1369,17 +2060,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1387,19 +2091,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1408,19 +2123,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1428,19 +2154,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1449,19 +2186,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1469,19 +2217,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1490,19 +2249,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "created_at", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1510,19 +2280,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1531,20 +2312,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1552,21 +2343,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", - "repo_id", - "request_id", + "@timestamp", + "_document_id", "action", "actor", - "org_id", - "_document_id", "actor_id", - "operation_type", - "@timestamp", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -1574,20 +2374,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo_id", "@timestamp", - "actor", - "user_agent", - "request_id", - "org", "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "repo", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -1595,22 +2405,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "user_agent", - "actor_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "title", - "_document_id", - "created_at", - "repo", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -1618,21 +2437,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "team", - "created_at", - "user_id", "@timestamp", - "number", - "org", - "title", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", "user_agent", - "operation_type", - "_document_id" + "team", + "created_at", + "number", + "title", + "operation_type" ] }, { @@ -1640,18 +2471,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user_id", - "actor", "number", - "user", - "created_at", - "request_id", - "_document_id" + "created_at" ] }, { @@ -1659,18 +2503,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "action", - "_document_id", - "request_id", - "org", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org_id", "user_agent", - "actor", + "operation_type", "number", "team", "created_at" @@ -1681,21 +2536,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "_document_id", - "title", - "user", - "user_agent", - "org", - "operation_type", - "actor_id", "@timestamp", - "actor", - "team", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", + "title", + "operation_type", + "team", "number" ] }, @@ -1704,17 +2570,31 @@ "description": "A global announcement banner was created for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -1725,16 +2605,30 @@ "description": "A global announcement banner was removed from the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -1745,18 +2639,32 @@ "description": "A global announcement banner was updated for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", "old_message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -1767,17 +2675,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was created.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", - "operation_type", "@timestamp", "_document_id", - "org_id", "action", - "request_id", - "org", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -1786,17 +2707,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was deleted.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", + "@timestamp", "_document_id", "action", - "@timestamp", - "actor_id", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -1805,22 +2739,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1829,22 +2772,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1852,28 +2805,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1882,27 +2841,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -1911,25 +2878,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1938,26 +2913,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1966,21 +2948,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1989,22 +2983,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2013,25 +3017,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2040,22 +3053,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -2064,21 +3089,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -2089,19 +3124,30 @@ "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2110,20 +3156,30 @@ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2132,19 +3188,30 @@ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2153,23 +3220,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2177,18 +3253,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -2199,20 +3285,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2222,25 +3318,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -2248,25 +3354,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -2274,26 +3389,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -2302,25 +3426,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -2328,26 +3461,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "events", - "repo", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -2355,21 +3497,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -2378,19 +3531,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -2398,21 +3564,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -2421,19 +3598,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -2444,20 +3635,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2467,24 +3670,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2495,23 +3709,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2522,21 +3748,33 @@ "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", "operation_type", - "@timestamp", "integration", - "action", - "user_agent", "reason", - "_document_id", - "org", - "org_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -2547,20 +3785,32 @@ "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ "@timestamp", - "actor_id", - "org", "_document_id", - "requester", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "requester", "created_at", "url", - "org_id", - "request_id", "operation_type", - "actor", "integration", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -2570,20 +3820,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2593,19 +3856,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -2614,20 +3891,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -2637,20 +3927,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -2659,20 +3962,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -2681,20 +3997,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -2702,19 +4030,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2723,19 +4064,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2744,17 +4098,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2767,21 +4134,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -2795,17 +4175,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2817,19 +4210,30 @@ "description": "An IP allow list was disabled.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "actor", - "request_id", - "org", - "user_agent", + "@timestamp", "_document_id", - "user_id", + "action", + "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "@timestamp", - "user" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2837,19 +4241,30 @@ "description": "An IP allow list was disabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2857,20 +4272,29 @@ "description": "An IP allow list was enabled.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "user_id", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "business_id", - "_document_id", - "action", - "@timestamp", + "user_id", "user_agent", - "actor_id", "operation_type", - "org", "created_at" ] }, @@ -2879,19 +4303,30 @@ "description": "An IP allow list was enabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2899,24 +4334,32 @@ "description": "An IP address was added to an IP allow list.", "docs_reference_links": "N/A", "fields": [ - "active", - "org", - "ip_allow_list_entry", "@timestamp", "_document_id", - "operation_type", - "created_at", - "user_agent", "action", - "request_id", + "actor", "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "business", - "actor", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", + "ip_allow_list_entry", + "operation_type", + "created_at" ] }, { @@ -2924,24 +4367,32 @@ "description": "An IP address was deleted from an IP allow list.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "ip_allow_list_entry", - "org", - "operation_type", - "created_at", - "active", "action", - "@timestamp", + "actor", + "actor_id", "business", "business_id", - "user_agent", + "hashed_token", + "org", "org_id", - "actor", - "actor_id", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ip_allow_list_entry", + "operation_type", + "created_at", + "active" ] }, { @@ -2949,19 +4400,32 @@ "description": "An IP address or its description was changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "actor_id", "ip_allow_list_entry", - "active", - "org_id", - "@timestamp" + "active" ] }, { @@ -2969,22 +4433,31 @@ "description": "A comment on an issue was deleted from the repository.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "org", - "repo", - "actor_id", "@timestamp", - "created_at", "_document_id", "action", - "operation_type", - "user_agent", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "oauth_application_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -2992,24 +4465,30 @@ "description": "A comment on an issue was pinned to a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3020,19 +4499,29 @@ "description": "A comment on an issue was unpinned from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3043,22 +4532,31 @@ "description": "A comment on an issue (other than the initial one) changed.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", - "action", - "repo_id", - "org_id", - "created_at", - "operation_type", "@timestamp", - "user_agent", - "request_id", "_document_id", - "actor_id", + "action", "actor", - "oauth_application_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -3066,21 +4564,31 @@ "description": "An issue was deleted from the repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", "fields": [ - "user", - "actor_id", - "created_at", - "title", "@timestamp", "_document_id", - "request_id", - "actor", - "user_id", "action", - "operation_type", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "title", + "operation_type" ], "docs_reference_titles": "Deleting an issue" }, @@ -3089,23 +4597,33 @@ "description": "An issue was pinned to a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ + "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", "action", "actor", - "operation_type", - "owner_type", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "number", - "repo", - "event", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type", + "owner_type", + "number", + "event" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -3114,22 +4632,32 @@ "description": "An issue was transferred to another repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "owner_type", - "actor_id", "number", - "repo", "operation_type", - "_document_id", - "repo_id", - "action", - "request_id", - "created_at", - "actor", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Transferring an issue to another repository" }, @@ -3138,24 +4666,33 @@ "description": "An issue was unpinned from a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ - "event", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", - "action", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "operation_type", - "_document_id", - "number", - "owner_type", - "@timestamp", + "token_id", + "token_scopes", "user", "user_id", - "token_scopes", - "request_access_security_header" + "user_agent", + "event", + "created_at", + "operation_type", + "number", + "owner_type" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -3164,19 +4701,30 @@ "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user_agent", - "action", "@timestamp", - "operation_type", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "user_id", - "created_at", - "_document_id", - "actor", + "token_id", + "token_scopes", "user", - "org", - "org_id" + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3185,18 +4733,29 @@ "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -3206,19 +4765,30 @@ "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user", - "request_id", - "actor", - "business_id", - "action", - "operation_type", - "user_agent", - "created_at", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor_id" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3227,18 +4797,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3246,21 +4828,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -3268,21 +4863,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -3290,22 +4898,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -3313,19 +4934,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -3335,22 +4969,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -3358,22 +5005,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -3381,20 +5041,30 @@ "description": "The ability for members to publish GitHub Pages sites was disabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3403,20 +5073,30 @@ "description": "The ability for members to publish GitHub Pages sites was enabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3425,21 +5105,30 @@ "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3448,22 +5137,30 @@ "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3472,21 +5169,30 @@ "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3495,22 +5201,30 @@ "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3519,19 +5233,30 @@ "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "operation_type", "user_agent", - "actor", - "actor_id", - "business_id", - "@timestamp", - "created_at", - "action" + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3540,18 +5265,29 @@ "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "request_id", - "org", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "actor", "operation_type", - "org_id", - "action", - "@timestamp", "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -3561,21 +5297,30 @@ "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "action", - "org_id", - "user_id", - "business", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business_id", + "user_id", + "user_agent", "created_at", - "actor", - "org", - "operation_type", - "user_agent" + "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3586,16 +5331,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -3604,21 +5360,30 @@ "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "created_at", - "user_id", "business_id", - "user", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "org_id", - "@timestamp" + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -3627,19 +5392,30 @@ "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ - "request_id", - "created_at", - "_document_id", - "user_agent", - "user", - "user_id", - "business", - "business_id", - "operation_type", "@timestamp", + "_document_id", "action", "actor", - "actor_id" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -3648,19 +5424,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3668,21 +5456,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3692,16 +5489,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3711,18 +5521,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3732,14 +5555,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -3747,19 +5586,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -3767,18 +5617,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -3786,23 +5648,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -3810,16 +5680,30 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "org_id", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3827,24 +5711,32 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", - "repo_id", "operation_type", - "@timestamp", - "user_agent", "created_at", - "org", - "action", - "_document_id", - "repo", - "actor", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3852,15 +5744,28 @@ "description": "A network configuration for a hosted compute service was created.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -3878,15 +5783,28 @@ "description": "A network configuration for a hosted compute service was deleted.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -3899,15 +5817,28 @@ "description": "A network configuration for a hosted compute service was updated.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -3924,20 +5855,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3946,20 +5889,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3968,20 +5923,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3990,20 +5957,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "oauth_application", - "oauth_application_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4012,19 +5991,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4033,20 +6025,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4055,20 +6059,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4077,19 +6093,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4098,17 +6127,28 @@ "description": "An invitation sent to an organization to join an enterprise was accepted.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4119,20 +6159,30 @@ "description": "A billing manager was added to an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "org", - "user_id", "action", - "created_at", - "org_id", - "user", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" }, @@ -4141,21 +6191,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -4164,24 +6224,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4189,21 +6259,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org_id", - "org", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -4211,20 +6291,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -4232,22 +6322,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -4255,20 +6353,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -4276,22 +6384,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -4299,19 +6415,30 @@ "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -4320,19 +6447,30 @@ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -4342,15 +6480,28 @@ "description": "Third-party application access for outside collaborators was disabled for the organization.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4361,15 +6512,28 @@ "description": "Third-party application access for outside collaborators was enabled for the organization.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4380,15 +6544,28 @@ "description": "The organization was archived.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4398,17 +6575,30 @@ "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", "fields": [ - "org_id", - "operation_type", "@timestamp", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" }, @@ -4417,21 +6607,32 @@ "description": "An export of the organization's Git events was created.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "start", "end", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" }, @@ -4440,16 +6641,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_agent", - "action", "@timestamp", - "actor_id", - "org_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -4458,18 +6672,31 @@ "description": "An organization owner blocked a user from accessing the organization's repositories.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", "fields": [ - "actor", - "user_agent", - "org_id", - "created_at", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "blocked_user", + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" }, @@ -4478,19 +6705,30 @@ "description": "An invitation for an organization to join an enterprise was revoked", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "initiated_from" ], "docs_reference_titles": "Adding organizations to your enterprise" @@ -4500,22 +6738,33 @@ "description": "An invitation sent to a user to join an organization was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "email", - "@timestamp", - "actor", - "action", "operation_type", - "user_agent", - "org", "invitation_id", - "_document_id", "created_at", - "invitee_email", - "token_scopes", - "programmatic_access_type" + "invitee_email" ] }, { @@ -4523,19 +6772,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -4543,23 +6803,31 @@ "description": "Autofix for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4567,21 +6835,31 @@ "description": "Autofix for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4589,21 +6867,30 @@ "description": "Code scanning using the default setup was disabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -4612,21 +6899,30 @@ "description": "Code scanning using the default setup was enabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -4635,20 +6931,31 @@ "description": "Access to use Codespaces on internal and private repositories was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "enablement", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "enablement", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization" }, @@ -4657,21 +6964,31 @@ "description": "Ownership and payment for codespaces was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "owner_type", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" }, @@ -4680,16 +6997,29 @@ "description": "A team has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4699,16 +7029,29 @@ "description": "A team has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4718,19 +7061,30 @@ "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -4739,17 +7093,30 @@ "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -4758,21 +7125,30 @@ "description": "A user has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -4780,21 +7156,30 @@ "description": "A user has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -4802,16 +7187,29 @@ "description": "The interaction limit for collaborators only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "request_id", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" @@ -4821,17 +7219,30 @@ "description": "The interaction limit for prior contributors only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "operation_type", "@timestamp", - "created_at", - "user_agent", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", - "actor", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -4840,17 +7251,30 @@ "description": "The interaction limit for existing users only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", "_document_id", - "operation_type", - "actor_id", - "org_id", "action", - "created_at", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -4860,16 +7284,29 @@ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ "@timestamp", - "created_at", "_document_id", - "actor_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "action", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -4878,17 +7315,30 @@ "description": "The interaction limit for prior contributors only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "operation_type", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -4897,17 +7347,30 @@ "description": "The interaction limit for existing users only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "actor_id", - "request_id", + "@timestamp", + "_document_id", "action", - "created_at", - "user_agent", "actor", - "_document_id", - "org_id", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -4916,22 +7379,30 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" }, @@ -4940,17 +7411,28 @@ "description": "An invitation for an organization to join an enterprise was confirmed.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4961,15 +7443,28 @@ "description": "Server statistics were exported for the organization.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4980,18 +7475,30 @@ "description": "An organization was created.", "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", "fields": [ - "request_id", - "org", - "actor_id", - "actor", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "org_id", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" }, @@ -5000,20 +7507,31 @@ "description": "A GitHub Actions secret was created for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5022,20 +7540,32 @@ "description": "A GitHub Actions variable was created for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5044,21 +7574,33 @@ "description": "A Codespaces or Dependabot secret was created for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -5066,21 +7608,30 @@ "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor_id", - "org_id", - "business", - "action", "@timestamp", - "org", "_document_id", - "business_id", + "action", "actor", - "token_scopes", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "actor_is_bot", "oauth_credential_type", "managed_oauth_access_id", @@ -5096,24 +7647,32 @@ "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", "fields": [ - "user_agent", - "actor", "@timestamp", - "created_at", - "org_id", - "business_id", - "operation_type", - "request_id", "_document_id", "action", + "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", - "token_scopes", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot", "oauth_credential_type", - "request_access_security_header", "managed_oauth_access_id", "managed_token_id", "managed_oauth_scopes", @@ -5127,21 +7686,32 @@ "description": "An owner revoked authorized credentials.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "oauth_application_id", - "org_id", "operation_type", - "action", - "business", - "request_id", "created_at", - "business_id", - "actor_id", - "_document_id", - "user_agent", "oauth_credential_type", "managed_oauth_access_id", "managed_token_id", @@ -5156,18 +7726,30 @@ "description": "An organization was deleted by a user or staff.", "docs_reference_links": "N/A", "fields": [ - "user_agent", "@timestamp", "_document_id", - "created_at", - "actor", - "org_id", - "org", "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5175,20 +7757,30 @@ "description": "Team creation was limited to owners.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "actor", "@timestamp", "_document_id", - "user", - "user_id", "action", - "created_at", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -5197,16 +7789,29 @@ "description": "Third-party application access restrictions for an organization were disabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "org_id", - "action", - "_document_id", - "request_id", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" @@ -5216,19 +7821,30 @@ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -5237,14 +7853,31 @@ "description": "SAML single sign-on was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sso_url", "issuer", - "action", - "@timestamp", - "_document_id", "created_at", - "org", "operation_type" ] }, @@ -5253,21 +7886,30 @@ "description": "Display of IP addresses within audit log events for the organization was disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" }, @@ -5276,17 +7918,30 @@ "description": "A two-factor authentication requirement was disabled for the organization.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "org_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "_document_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5294,19 +7949,30 @@ "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "user", - "action", - "operation_type", "@timestamp", "_document_id", - "created_at", - "user_agent", - "org", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5314,19 +7980,30 @@ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "user", - "action", - "actor_id", - "org_id" + "created_at" ] }, { @@ -5334,19 +8011,30 @@ "description": "Team creation by members was allowed.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "org_id", - "user", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -5355,17 +8043,30 @@ "description": "Third-party application access restrictions for an organization were enabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "operation_type", - "org", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" }, @@ -5374,19 +8075,30 @@ "description": "An organization owner allowed users with read access to create discussions in an organization", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -5395,19 +8107,32 @@ "description": "SAML single sign-on was enabled for the organization.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", - "sso_url", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "@timestamp", - "issuer", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "sso_url", + "created_at", + "issuer" ], "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" }, @@ -5416,21 +8141,30 @@ "description": "Display of IP addresses within audit log events for the organization was enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" }, @@ -5439,17 +8173,30 @@ "description": "Two-factor authentication is now required for the organization.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "actor_id", - "action", - "_document_id", - "org", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org_id", "operation_type", - "created_at", - "request_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" }, @@ -5458,17 +8205,30 @@ "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "org_id", - "manager", "@timestamp", - "request_id", - "actor", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "manager", + "operation_type", "created_at" ] }, @@ -5477,18 +8237,31 @@ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", "docs_reference_links": "N/A", "fields": [ - "org_id", "@timestamp", - "org", - "user_agent", - "request_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "manager", "operation_type", - "created_at", - "_document_id" + "created_at" ] }, { @@ -5496,23 +8269,32 @@ "description": "A new user was invited to join an organization.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", "fields": [ - "org", - "user_id", - "invitation_id", - "org_id", - "user", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", - "created_at", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "invitee_email", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitation_id", + "operation_type", + "created_at", + "invitee_email" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" }, @@ -5521,17 +8303,28 @@ "description": "An organization was invited to join an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5541,19 +8334,30 @@ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -5561,19 +8365,30 @@ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "org", - "org_id", - "user_agent", - "actor_id", - "user_id", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5581,19 +8396,31 @@ "description": "Access to an organization was granted for an OAuth App.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "request_id", "actor_id", - "operation_type", - "org_id", - "_document_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" @@ -5603,20 +8430,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -5625,18 +8463,31 @@ "description": "Access was disabled for an OAuth App that was previously approved.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", "fields": [ - "request_id", - "url", - "created_at", - "org_id", - "action", "@timestamp", "_document_id", - "user_agent", - "org", - "operation_type", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", + "operation_type", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" @@ -5646,19 +8497,31 @@ "description": "An organization member requested that an owner grant an OAuth App access to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", + "@timestamp", "_document_id", - "request_id", - "url", - "org_id", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "url", "oauth_application_name" ] }, @@ -5667,20 +8530,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -5690,16 +8564,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "org_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type", - "_document_id", - "org" + "created_at", + "operation_type" ] }, { @@ -5707,20 +8594,31 @@ "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "reason", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "reason", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -5729,20 +8627,30 @@ "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -5751,19 +8659,30 @@ "description": "An organization owner downloaded the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -5772,19 +8691,30 @@ "description": "An organization owner generated the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -5793,19 +8723,30 @@ "description": "An organization owner printed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -5814,19 +8755,30 @@ "description": "An organization owner viewed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -5835,19 +8787,31 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", "fields": [ - "actor", - "operation_type", "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "actor_is_bot", - "request_access_security_header" + "operation_type", + "created_at", + "actor_is_bot" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -5856,20 +8820,31 @@ "description": "A GitHub Actions secret was removed from an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5878,21 +8853,31 @@ "description": "A GitHub Actions variable was removed from an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5901,18 +8886,29 @@ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "user_id", - "user_agent", - "org_id", - "user", - "action", - "_document_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" @@ -5922,22 +8918,32 @@ "description": "A Codespaces or Dependabot secret was removed from an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -5945,21 +8951,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5967,21 +8982,30 @@ "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ - "org", - "user", - "org_id", - "created_at", - "request_id", "@timestamp", - "action", - "operation_type", - "user_agent", "_document_id", + "action", "actor", "actor_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5989,21 +9013,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -6011,18 +9045,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", "fields": [ - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "actor", - "action", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -6031,19 +9077,31 @@ "description": "An organization was renamed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "_document_id", "@timestamp", - "org", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_login", - "org_id", - "request_id", - "actor_id", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -6051,14 +9109,28 @@ "description": "Triggered when a required workflow is created.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6069,14 +9141,28 @@ "description": "Triggered when a required workflow is deleted.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6087,14 +9173,28 @@ "description": "Triggered when a required workflow is updated.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6105,20 +9205,30 @@ "description": "An organization member was restored.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", "fields": [ - "user", - "actor", - "user_id", + "@timestamp", "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "actor_id", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" }, @@ -6127,18 +9237,29 @@ "description": "A member's linked identity was revoked.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", "user_id", - "@timestamp", - "action", - "actor_id", "user_agent", - "_document_id", - "request_id", + "operation_type", "created_at" ], "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" @@ -6148,19 +9269,30 @@ "description": "A member's SAML session was revoked.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", "fields": [ - "actor_id", - "created_at", - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" }, @@ -6169,21 +9301,33 @@ "description": "A self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" @@ -6193,21 +9337,31 @@ "description": "A self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6216,20 +9370,31 @@ "description": "A self-hosted runner group was renamed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6238,23 +9403,33 @@ "description": "The REST API was used to remove a self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", "oauth_application_id", "runner_group_id", "runner_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -6263,23 +9438,31 @@ "description": "A self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6288,19 +9471,32 @@ "description": "A runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -6309,25 +9505,36 @@ "description": "The configuration of a self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6336,21 +9543,32 @@ "description": "The visibility of a self-hosted runner group was updated via the REST API.", "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", - "visibility", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" }, @@ -6359,21 +9577,30 @@ "description": "Automatic partner validation checks have been disabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -6383,21 +9610,30 @@ "description": "Automatic partner validation checks have been enabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -6407,20 +9643,30 @@ "description": "A custom pattern was created for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6429,22 +9675,30 @@ "description": "A custom pattern was removed from secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6453,21 +9707,30 @@ "description": "A custom pattern was published for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6476,21 +9739,30 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6499,22 +9771,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6523,21 +9803,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6546,22 +9835,30 @@ "description": "Generic secrets have been disabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -6569,22 +9866,30 @@ "description": "Generic secrets have been enabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -6592,21 +9897,30 @@ "description": "Secret scanning for non-provider patterns was disabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -6616,21 +9930,30 @@ "description": "Secret scanning for non-provider patterns was enabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -6640,19 +9963,30 @@ "description": "A role or team was added to the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -6662,21 +9996,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -6686,21 +10029,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -6710,19 +10062,30 @@ "description": "A role or team was removed from the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -6732,22 +10095,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -6756,22 +10127,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -6780,22 +10159,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -6804,21 +10191,30 @@ "description": "Push protection for secret scanning was disabled.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -6827,21 +10223,30 @@ "description": "Push protection for secret scanning was enabled.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -6850,22 +10255,30 @@ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -6874,22 +10287,30 @@ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -6898,26 +10319,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6925,28 +10354,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6954,26 +10391,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6981,15 +10426,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -6998,15 +10460,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -7015,7 +10494,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -7030,20 +10530,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -7052,16 +10563,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -7072,18 +10596,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -7092,17 +10629,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", "_document_id", - "org_id", - "operation_type", + "action", "actor", "actor_id", - "@timestamp", - "request_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", - "action" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7110,18 +10660,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -7130,18 +10692,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -7150,18 +10725,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -7170,22 +10757,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", "actor_id", - "org_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issuer", - "business", "operation_type", "created_at", - "request_id", - "business_id", - "_document_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7193,21 +10790,32 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Adding organizations to your enterprise" }, @@ -7216,19 +10824,30 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -7239,15 +10858,28 @@ "description": "The organization was unarchived.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7257,19 +10889,32 @@ "description": "A user was unblocked from an organization.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", "fields": [ - "oauth_application_id", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", - "@timestamp", - "request_id", - "created_at", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "blocked_user", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" }, @@ -7278,20 +10923,32 @@ "description": "A GitHub Actions secret was updated for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "created_at", "key", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -7300,23 +10957,34 @@ "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "updated_allowed_types", "old_policy", - "updated_access_policy", - "programmatic_access_type", - "request_access_security_header" + "updated_access_policy" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" }, @@ -7325,20 +10993,32 @@ "description": "A GitHub Actions variable was updated for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -7347,20 +11027,32 @@ "description": "The default repository permission level for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", + "created_at", "permission", - "actor_id", - "old_permission", - "_document_id", - "programmatic_access_type" + "old_permission" ] }, { @@ -7368,22 +11060,33 @@ "description": "A Codespaces or Dependabot secret was updated for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -7392,20 +11095,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -7413,17 +11127,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -7433,20 +11160,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -7455,17 +11193,30 @@ "description": "The name of the default branch was changed for new repositories in the organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" }, @@ -7474,17 +11225,30 @@ "description": "The repository self-hosted runners policy was updated", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_repo_runners_policy", "new_repo_runners_policy", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -7495,19 +11259,32 @@ "description": "An organization's SAML provider settings were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "sso_url", - "actor_id", - "operation_type", "@timestamp", - "issuer", - "org", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "operation_type", + "issuer", + "created_at" ] }, { @@ -7515,18 +11292,30 @@ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", "fields": [ - "request_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "_document_id", - "org", - "action", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" }, @@ -7535,18 +11324,30 @@ "description": "A default label was created for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", "fields": [ - "request_id", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", - "_document_id", - "action", - "created_at", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" }, @@ -7555,17 +11356,30 @@ "description": "A default label was deleted for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", "fields": [ - "operation_type", - "request_id", - "actor", "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" }, @@ -7574,17 +11388,30 @@ "description": "A default label was edited for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", "fields": [ - "org", - "created_at", "@timestamp", - "actor", + "_document_id", "action", - "user_agent", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" }, @@ -7593,20 +11420,33 @@ "description": "A domain was approved for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "org_id", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" }, @@ -7615,16 +11455,31 @@ "description": "A domain was added to an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "created_at", + "@timestamp", "_document_id", - "domain_name", "action", - "request_id", + "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "domain_name", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -7633,14 +11488,29 @@ "description": "A domain was removed from an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", "fields": [ - "action", - "domain_name", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "domain_name", "operation_type", "created_at" ], @@ -7651,16 +11521,31 @@ "description": "A domain was verified for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "operation_type", - "domain_name", "@timestamp", - "user_agent", - "request_id", - "actor", - "action", - "created_at", "_document_id", - "actor_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "domain_name", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -7669,16 +11554,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -7688,17 +11586,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7708,16 +11617,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -7727,20 +11649,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -7748,19 +11680,30 @@ "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor", - "business_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", "user_agent", - "_document_id", "created_at", - "operation_type", - "request_id", - "business" + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -7769,19 +11712,30 @@ "description": "Organization projects were disabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "operation_type", - "@timestamp", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -7790,18 +11744,29 @@ "description": "Organization projects were enabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor_id", - "org_id", - "created_at", - "user_id", - "org", "@timestamp", "_document_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", + "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" @@ -7811,23 +11776,33 @@ "description": "An organization role was assigned to a user or team.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About custom organization roles" }, @@ -7836,25 +11811,32 @@ "description": "A custom organization role was created in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -7866,25 +11848,32 @@ "description": "A custom organization role was deleted in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -7895,19 +11884,30 @@ "description": "A user or team was unassigned an organization role.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type" ], @@ -7918,26 +11918,33 @@ "description": "A custom organization role was edited in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", "old_role_permissions", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -7950,20 +11957,31 @@ "description": "An entire package was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" @@ -7973,23 +11991,34 @@ "description": "A package was published or republished to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "ecosystem", "version_count", "is_republished", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -7998,21 +12027,32 @@ "description": "A specific package version was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "version", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "ecosystem", "actor_is_bot" ], @@ -8023,21 +12063,34 @@ "description": "A specific package version was published or republished to a package.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "ecosystem", "package", "version", - "actor_id", - "user_agent", "is_republished", - "actor", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -8046,20 +12099,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -8068,17 +12135,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8089,20 +12171,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -8111,18 +12207,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8130,16 +12238,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8147,18 +12269,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8166,18 +12300,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8188,18 +12335,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8210,17 +12370,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8231,18 +12404,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8254,17 +12440,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8276,20 +12475,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was created.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -8301,20 +12509,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -8326,20 +12543,29 @@ "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -8351,20 +12577,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -8376,15 +12611,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8394,17 +12644,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8414,15 +12675,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8432,19 +12708,30 @@ "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "action", - "operation_type", "@timestamp", - "business_id", + "_document_id", + "action", + "actor", "actor_id", - "user", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8452,23 +12739,30 @@ "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "created_at", - "actor_id", + "@timestamp", "_document_id", - "actor", - "user", - "repo", "action", - "user_agent", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "request_id", - "user_id", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8476,23 +12770,30 @@ "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_id", - "operation_type", + "@timestamp", "_document_id", "action", - "@timestamp", - "repo", - "org", - "business", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org_id", - "created_at", - "business_id" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8500,17 +12801,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8520,17 +12832,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8540,17 +12863,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8560,17 +12894,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8580,17 +12925,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -8600,17 +12958,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8618,20 +12989,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -8641,25 +13023,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -8667,20 +13061,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8688,25 +13094,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8714,17 +13132,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -8732,17 +13163,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -8750,18 +13194,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -8770,18 +13226,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -8790,19 +13258,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -8810,17 +13289,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -8832,22 +13324,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -8855,19 +13356,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -8875,17 +13387,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8893,18 +13418,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -8912,20 +13450,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8933,18 +13481,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -8953,18 +13513,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -8973,16 +13545,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -8994,21 +13579,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "project_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -9016,22 +13613,32 @@ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", "fields": [ - "repo", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "name", "created_at", - "_document_id", "operation_type", - "actor", - "repo_id", - "org", - "request_id", - "actor_id", - "oauth_application_id", - "@timestamp", - "programmatic_access_type" + "oauth_application_id" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" }, @@ -9040,29 +13647,34 @@ "description": "A protected branch allowance was given to a specific user, team or integration.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "authorized_actors", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -9070,24 +13682,32 @@ "description": "Branch protection was enabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "repo_id", - "user_id", "@timestamp", - "user_agent", - "repo", - "name", - "org_id", - "user", "_document_id", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", "created_at", "authorized_actor_names", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -9098,21 +13718,31 @@ "description": "Branch protection was disabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "repo", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", - "request_id", - "repo_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "name", + "operation_type", "created_at", - "_document_id", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -9123,22 +13753,32 @@ "description": "Enforcement of dismissing stale pull requests was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "dismiss_stale_reviews_on_push", - "org_id", - "action", - "created_at", - "request_id", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismiss_stale_reviews_on_push", + "created_at", "operation_type", - "actor", - "repo", - "org", - "name", - "programmatic_access_type" + "name" ] }, { @@ -9146,24 +13786,34 @@ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "authorized_actors_only", "authorized_actors", "created_at", - "user_agent", "name", - "_document_id", - "org_id", - "request_id", - "@timestamp", - "actor_id", - "org", - "action", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -9171,30 +13821,37 @@ "description": "A branch protection requirement was overridden by a repository administrator.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "actor", "reasons", - "@timestamp", "before", "after", - "actor_id", - "repo", "operation_type", - "user_agent", "branch", "overridden_codes", - "org", - "org_id", - "action", - "_document_id", - "request_id", "referrer", - "business", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "rule_suite_id" ] @@ -9204,28 +13861,36 @@ "description": "A branch update attempt was rejected.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "business", - "org_id", "operation_type", - "request_id", - "repo_id", - "actor", "branch", "before", "overridden_codes", "after", - "action", "reasons", - "actor_id", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "actor_is_bot", "rule_suite_id" @@ -9236,23 +13901,32 @@ "description": "Branch protection was enforced for repository administrators.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "admin_enforced", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "name", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "action", "repo_id", - "org_id", - "_document_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "admin_enforced", + "operation_type", + "name", + "created_at" ] }, { @@ -9260,22 +13934,32 @@ "description": "Branch deletion was enabled or disabled for a protected branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "operation_type", - "request_id", - "repo", "@timestamp", - "org_id", - "org", - "action", - "allow_deletions_enforcement_level", "_document_id", - "created_at", - "actor_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_deletions_enforcement_level", + "created_at" ] }, { @@ -9283,23 +13967,32 @@ "description": "Force pushes were enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "actor_id", - "name", + "@timestamp", "_document_id", + "action", "actor", - "repo", - "operation_type", - "request_id", - "allow_force_pushes_enforcement_level", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_force_pushes_enforcement_level", + "created_at" ] }, { @@ -9307,24 +14000,33 @@ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "ignore_approvals_from_contributors", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -9333,22 +14035,32 @@ "description": "Required linear commit history was enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "operation_type", "actor", - "linear_history_requirement_enforcement_level", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "linear_history_requirement_enforcement_level", "name", - "org_id", - "repo_id", - "org", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ] }, { @@ -9356,24 +14068,33 @@ "description": "Fork syncing was enabled or disabled for a read-only branch", "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "lock_allows_fetch_and_merge", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -9382,27 +14103,34 @@ "description": "The enforcement of a branch lock was updated.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "enforcement_level", "lock_branch_enforcement_level", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -9411,18 +14139,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9433,24 +14174,33 @@ "description": "A branch name pattern was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "old_name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "old_name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -9458,25 +14208,32 @@ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", "docs_reference_links": "N/A", "fields": [ - "name", - "org_id", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "@timestamp", + "business", "business_id", - "request_id", - "pull_request_reviews_enforcement_level", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "business", - "user_agent", - "created_at", "repo_id", - "operation_type", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "pull_request_reviews_enforcement_level", + "created_at", + "operation_type" ] }, { @@ -9484,22 +14241,32 @@ "description": "Enforcement of required code owner review was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "created_at", - "require_code_owner_review", - "operation_type", - "name", - "user_agent", - "action", "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "request_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "require_code_owner_review", + "operation_type", + "name" ] }, { @@ -9507,22 +14274,33 @@ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "require_last_push_approval", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" }, @@ -9531,22 +14309,32 @@ "description": "Enforcement of the required number of approvals before merging was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "required_approving_review_count", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "required_approving_review_count", "created_at", - "actor", "operation_type", - "user_agent", - "name", - "org_id", - "action", - "actor_id", - "_document_id", - "org", - "@timestamp", - "programmatic_access_type" + "name" ] }, { @@ -9554,25 +14342,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "user_agent", "@timestamp", "_document_id", - "name", - "repo", "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "business", - "actor_id", - "operation_type", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "required_status_checks_enforcement_level", - "org", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "required_status_checks_enforcement_level" ] }, { @@ -9580,22 +14375,32 @@ "description": "Enforcement of required commit signing was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "name", "@timestamp", - "created_at", "_document_id", - "request_id", - "repo_id", - "org", - "org_id", "action", "actor", "actor_id", - "signature_requirement_enforcement_level", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "programmatic_access_type" + "operation_type", + "name", + "created_at", + "signature_requirement_enforcement_level" ] }, { @@ -9603,46 +14408,67 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "created_at", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "operation_type", + "strict_required_status_checks_policy" + ] + }, + { + "action": "public_key.create", + "description": "An SSH key was added to a user account or a deploy key was added to a repository.", + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "name", - "actor", - "repo", - "operation_type", - "action", - "strict_required_status_checks_policy", - "programmatic_access_type" - ] - }, - { - "action": "public_key.create", - "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", - "fields": [ "read_only", - "user_agent", - "actor_id", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -9651,24 +14477,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -9677,20 +14514,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -9699,21 +14550,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -9723,22 +14587,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -9747,25 +14623,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -9774,23 +14660,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", "key", "fingerprint", - "actor_id", - "actor", "title", - "user_agent", - "user_id", - "request_id", - "read_only", - "token_scopes", - "programmatic_access_type" + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -9799,18 +14696,32 @@ "description": "A pull request was closed without being merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" @@ -9820,21 +14731,32 @@ "description": "A pull request was converted to a draft.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", "pull_request_id", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" }, @@ -9843,19 +14765,32 @@ "description": "A pull request was created.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -9866,23 +14801,35 @@ "description": "A review was requested on a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -9892,17 +14839,31 @@ "description": "A pull request was marked as in progress.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -9910,19 +14871,32 @@ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -9930,19 +14904,32 @@ "description": "A pull request was merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" @@ -9952,21 +14939,32 @@ "description": "A pull request was marked as ready for review.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" }, @@ -9975,27 +14973,34 @@ "description": "A pull request was rebased.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "pull_request_url", "pull_request_title", - "user", - "user_id", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -10003,23 +15008,35 @@ "description": "A review request was removed from a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" }, @@ -10028,18 +15045,32 @@ "description": "A pull request was reopened after previously being closed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -10047,19 +15078,31 @@ "description": "A review comment was added to a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "comment_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -10069,20 +15112,31 @@ "description": "A review comment on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", "@timestamp", "_document_id", - "repo", - "created_at", - "request_id", - "comment_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "comment_id", + "operation_type" ] }, { @@ -10090,18 +15144,31 @@ "description": "A review comment on a pull request was changed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "request_id", - "actor_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "_document_id", - "@timestamp", - "comment_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "comment_id" ] }, { @@ -10109,21 +15176,33 @@ "description": "A review on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ] }, { @@ -10131,20 +15210,33 @@ "description": "A review on a pull request was dismissed.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" }, @@ -10153,19 +15245,33 @@ "description": "A review on a pull request was submitted.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" @@ -10175,22 +15281,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -10199,21 +15315,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -10222,25 +15347,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -10249,23 +15381,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -10274,24 +15414,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -10300,23 +15447,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -10326,22 +15481,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -10350,19 +15514,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -10371,24 +15548,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -10397,24 +15584,32 @@ "description": "Autofix for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -10422,24 +15617,32 @@ "description": "Autofix for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -10447,23 +15650,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "tool", - "branch", - "category", - "repo", - "repo_id", - "public_repo", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "tool", + "branch", + "category", + "public_repo", "created_at", "operation_type" ], @@ -10474,25 +15686,31 @@ "description": "Code scanning using the default setup was disabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -10501,26 +15719,34 @@ "description": "Code scanning using the default setup was enabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "query_suite", "threat_model", - "languages", - "request_access_security_header" + "languages" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -10529,25 +15755,34 @@ "description": "Code scanning using the default setup was updated for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "query_suite", "threat_model", "languages", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Configuring default setup for code scanning" @@ -10557,19 +15792,30 @@ "description": "GitHub Codespaces was granted trusted repository access to this repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -10578,19 +15824,30 @@ "description": "GitHub Codespaces trusted repository access to this repository was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -10598,17 +15855,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -10617,15 +15887,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -10636,16 +15919,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -10655,39 +15951,63 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, { - "action": "repo.config.enable_contributors_only", - "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "action": "repo.config.enable_contributors_only", + "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -10696,17 +16016,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -10715,26 +16048,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -10743,30 +16082,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -10776,20 +16120,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -10798,25 +16153,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -10825,23 +16188,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -10849,25 +16223,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -10877,23 +16260,32 @@ "description": "A source code archive of a repository was downloaded as a ZIP file.", "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" @@ -10903,23 +16295,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -10927,21 +16329,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -10949,21 +16361,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -10971,22 +16393,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -10994,21 +16425,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -11016,20 +16457,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11037,22 +16489,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -11060,18 +16521,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -11079,22 +16554,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ - "actor", - "actor_id", - "user_agent", - "request_id", - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -11102,21 +16587,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -11124,18 +16619,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -11144,22 +16651,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -11168,24 +16684,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -11194,23 +16718,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -11218,26 +16752,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -11246,21 +16785,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -11269,25 +16817,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "repo_id", - "user_agent", - "topic", - "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", "@timestamp", - "created_at", "_document_id", + "action", + "actor", "actor_id", + "business", "business_id", - "programmatic_access_type" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "topic", + "operation_type", + "created_at" ] }, { @@ -11295,22 +16849,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -11319,25 +16883,34 @@ "description": "A branch was renamed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "old_branch", - "new_branch", - "default_branch", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "old_branch", + "new_branch", + "default_branch", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch" @@ -11347,19 +16920,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -11367,17 +16951,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -11386,17 +16985,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -11405,7 +17019,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -11420,23 +17055,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -11446,20 +17090,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -11470,21 +17125,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -11493,22 +17159,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -11517,21 +17193,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -11540,22 +17227,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -11566,16 +17263,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -11585,22 +17293,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -11609,23 +17328,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -11635,19 +17364,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -11655,21 +17394,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -11678,50 +17427,66 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "old_policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "business", - "business_id" - ] - }, - { - "action": "repo.update_actions_secret", - "description": "A GitHub Actions secret was updated for a repository.", - "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", - "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", + "programmatic_access_type", "repo", "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", + "old_policy", "created_at", + "operation_type" + ] + }, + { + "action": "repo.update_actions_secret", + "description": "A GitHub Actions secret was updated for a repository.", + "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", + "fields": [ + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -11730,24 +17495,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -11756,25 +17531,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -11783,22 +17566,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -11807,26 +17599,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -11834,31 +17634,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -11867,22 +17674,30 @@ "description": "Someone closed a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", "fields": [ - "actor", - "repo", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "user_agent", - "actor_id", - "request_id", - "action", - "operation_type", - "created_at", - "repo_id", - "_document_id", + "hashed_token", "org", "org_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "About repository security advisories" }, @@ -11891,18 +17706,29 @@ "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "repo", - "org_id", - "actor", + "@timestamp", + "_document_id", "action", - "request_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "_document_id", + "operation_type", "created_at" ] }, @@ -11911,17 +17737,30 @@ "description": "GitHub made a security advisory public in the GitHub Advisory Database.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -11930,21 +17769,30 @@ "description": "GitHub withdrew a security advisory that was published in error.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -11952,18 +17800,30 @@ "description": "Someone opened a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", "repo_id", - "action", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -11971,21 +17831,30 @@ "description": "Someone published a security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", "@timestamp", - "actor", - "repo_id", "_document_id", - "repo", - "business_id", - "business", - "request_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "org" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -11993,17 +17862,30 @@ "description": "Someone reopened as draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "repo", - "action", - "created_at", "@timestamp", - "request_id", - "actor_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "public_repo" ] }, @@ -12012,21 +17894,30 @@ "description": "Someone edited a draft or published security advisory.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "repo_id", - "org_id", "business", - "actor", - "user_agent", - "created_at", - "_document_id", "business_id", - "repo", - "action", - "operation_type", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -12034,24 +17925,30 @@ "description": "Branch protections were disabled for the repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -12060,24 +17957,30 @@ "description": "Branch protections were enabled for this repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -12086,19 +17989,30 @@ "description": "Data use settings were disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "repo_id", - "request_id", - "actor_id", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -12107,21 +18021,30 @@ "description": "Data use settings were enabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "org", - "user_id", - "repo_id", "@timestamp", - "request_id", - "actor", + "_document_id", "action", - "operation_type", - "created_at", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org_id", - "_document_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -12130,23 +18053,30 @@ "description": "The dependency graph was disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "repo_id", - "operation_type", - "user_id", - "repo", + "@timestamp", "_document_id", - "actor", - "user", "action", - "@timestamp", - "org_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", - "request_id", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -12155,24 +18085,31 @@ "description": "The dependency graph was enabled for a private repository.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor_id", - "repo_id", + "created_at", "operation_type", - "actor", - "@timestamp", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12181,21 +18118,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -12203,21 +18150,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -12225,21 +18182,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -12247,20 +18215,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -12268,21 +18248,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -12290,19 +18281,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -12310,19 +18314,30 @@ "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", "fields": [ - "request_id", - "created_at", + "@timestamp", "_document_id", "action", - "user_agent", - "user", - "business_id", - "business", - "operation_type", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -12331,20 +18346,30 @@ "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "created_at", "@timestamp", - "repo", - "action", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "repo_id", - "actor", - "request_id", - "programmatic_access_type" + "created_at", + "operation_type" ] }, { @@ -12353,20 +18378,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", "created_at", - "org_id", - "action", - "user_id", - "operation_type", - "_document_id", - "actor_id", - "repo" + "operation_type" ] }, { @@ -12374,31 +18408,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -12407,19 +18449,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -12427,8 +18480,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -12437,23 +18489,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -12478,26 +18539,32 @@ "description": "Automatic partner validation checks have been disabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -12506,26 +18573,32 @@ "description": "Automatic partner validation checks have been enabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -12534,23 +18607,30 @@ "description": "A custom pattern was created for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12560,23 +18640,30 @@ "description": "A custom pattern was removed from secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12586,24 +18673,31 @@ "description": "A custom pattern was published for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12613,24 +18707,31 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -12639,24 +18740,31 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12666,23 +18774,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12692,23 +18807,31 @@ "description": "Secret scanning was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "public_repo", - "programmatic_access_type" + "public_repo" ], "docs_reference_titles": "About secret scanning" }, @@ -12717,22 +18840,30 @@ "description": "Secret scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -12740,24 +18871,32 @@ "description": "Generic secrets have been disabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -12765,22 +18904,31 @@ "description": "Generic secrets have been enabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -12789,24 +18937,32 @@ "description": "Secret scanning for non-provider patterns was disabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -12815,24 +18971,32 @@ "description": "Secret scanning for non-provider patterns was enabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -12841,19 +19005,31 @@ "description": "A role or team was added to the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -12862,24 +19038,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -12888,24 +19072,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -12914,19 +19106,31 @@ "description": "A role or team was removed from the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -12935,26 +19139,31 @@ "description": "Secret scanning push protection was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -12963,26 +19172,31 @@ "description": "Secret scanning push protection was enabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -12991,28 +19205,36 @@ "description": "A code security configuration was applied to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13020,27 +19242,35 @@ "description": "A code security configuration failed to attach to the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", - "repository_security_configuration_failure_reason", - "repo", - "repo_id", + "repository_security_configuration_failure_reason", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13048,28 +19278,36 @@ "description": "A code security configuration was removed from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13077,28 +19315,36 @@ "description": "A code security configuration was removed due to a change in repository or enterprise settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13106,20 +19352,30 @@ "description": "The repository visibility change setting was cleared for an organization or enterprise.", "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", "fields": [ - "created_at", + "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", "business", - "action", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business_id", - "@timestamp", "user_agent", - "actor", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise" }, @@ -13128,20 +19384,30 @@ "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user", - "org_id", - "created_at", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "_document_id", - "@timestamp", - "user_id", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13149,19 +19415,30 @@ "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "_document_id", "@timestamp", - "user_agent", - "user", - "created_at", - "org", - "org_id", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13169,29 +19446,37 @@ "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -13200,29 +19485,37 @@ "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -13231,19 +19524,32 @@ "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ - "operation_type", - "request_id", - "repo_id", "@timestamp", - "user_agent", - "alert_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "alert_id", + "created_at", + "alert_number" ], "docs_reference_titles": "About Dependabot alerts" }, @@ -13252,23 +19558,32 @@ "description": "A Dependabot alert was manually dismissed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "org_id", - "user_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "operation_type", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "alert_id", - "actor", - "repo", "created_at", - "org", - "_document_id", - "action", - "actor_id", "dismiss_reason", - "user", "dismiss_comment", "alert_number", "actor_is_bot" @@ -13279,21 +19594,33 @@ "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "public_repo", "owner", - "_document_id", - "@timestamp", "operation_type", - "token_scopes", "alert_number" ] }, @@ -13302,26 +19629,34 @@ "description": "A Dependabot alert was manually reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type", - "business", - "business_id", "public_repo", - "alert_number", - "request_access_security_header" + "alert_number" ] }, { @@ -13329,21 +19664,32 @@ "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", "docs_reference_links": "N/A", "fields": [ - "alert_id", - "repo", - "operation_type", - "action", - "repo_id", - "_document_id", - "user_agent", - "request_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "alert_id", + "operation_type", + "created_at", + "alert_number" ] }, { @@ -13351,20 +19697,30 @@ "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", "fields": [ - "org", + "@timestamp", "_document_id", - "repo", - "org_id", - "operation_type", - "created_at", - "actor", "action", - "@timestamp", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" }, @@ -13373,24 +19729,31 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -13398,26 +19761,32 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13425,23 +19794,30 @@ "description": "Dependabot alerts was disabled.", "docs_reference_links": "N/A", "fields": [ - "repo", - "request_id", - "repo_id", - "action", - "actor_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "_document_id", "user_id", - "operation_type", - "token_scopes", - "programmatic_access_type" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13449,23 +19825,30 @@ "description": "Dependabot alerts was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_agent", - "created_at", "@timestamp", - "repo_id", + "_document_id", "action", - "user", - "repo", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor_id", - "_document_id", - "user_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot" ] }, @@ -13474,24 +19857,31 @@ "description": "A status check was marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "org", - "actor_id", "@timestamp", - "business", - "request_id", - "context", - "repo_id", - "action", - "repo", "_document_id", - "operation_type", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "actor", - "created_at", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "context", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -13500,21 +19890,31 @@ "description": "A status check was no longer marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "actor_id", - "actor", - "created_at", - "context", - "operation_type", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "repo_id", "org_id", - "action", - "_document_id", + "programmatic_access_type", "repo", - "programmatic_access_type" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "context", + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -13523,18 +19923,31 @@ "description": "Email notification restrictions for an organization or enterprise were disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -13543,19 +19956,31 @@ "description": "Email notification restrictions for an organization or enterprise were enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -13564,22 +19989,33 @@ "description": "A new custom repository role was created.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "owner", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", - "_document_id", "role_permissions", "old_role_permissions" ], @@ -13590,23 +20026,34 @@ "description": "A custom repository role was deleted.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Managing custom repository roles for an organization" }, @@ -13615,23 +20062,34 @@ "description": "A custom repository role was edited.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "old_role_permissions", "old_base_role" ], @@ -13642,14 +20100,28 @@ "description": "GitHub detected a secret and created a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -13663,22 +20135,32 @@ "description": "A secret scanning alert was reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type_display_name" ] }, @@ -13687,14 +20169,28 @@ "description": "A leaked secret was reported to the secret's provider by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "created_at", @@ -13709,28 +20205,37 @@ "description": "A secret scanning alert was resolved.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "resolution", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", + "resolution", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type", "secret_type_display_name", "publicly_leaked", - "multi_repo", - "request_access_security_header" + "multi_repo" ] }, { @@ -13738,25 +20243,32 @@ "description": "A secret scanning alert was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -13764,14 +20276,28 @@ "description": "A secret scanning alert was validated.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "previous_validity", @@ -13788,19 +20314,30 @@ "description": "Secret scanning was disabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -13809,19 +20346,30 @@ "description": "Secret scanning was enabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -13830,20 +20378,30 @@ "description": "Secret scanning was disabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -13852,19 +20410,30 @@ "description": "Secret scanning was enabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -13873,14 +20442,28 @@ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "push_protection_bypass_reason", @@ -13898,25 +20481,33 @@ "description": "A request to bypass secret scanning push protection was approved by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -13925,25 +20516,33 @@ "description": "A request to bypass secret scanning push protection was denied by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", - "request_access_security_header", "request_reviewer_comment" ], "docs_reference_titles": "About push protection" @@ -13953,25 +20552,33 @@ "description": "A user requested to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" }, @@ -13980,10 +20587,28 @@ "description": "A security configuration was created", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -13998,15 +20623,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -14024,22 +20642,33 @@ "description": "A default security configuration setting for new repositories was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14048,22 +20677,33 @@ "description": "A default security configuration setting for new repositories was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14072,10 +20712,28 @@ "description": "A security configuration was deleted", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -14090,15 +20748,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -14115,15 +20766,30 @@ "description": "A security configuration policy was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enforcement", "security_configuration_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14133,10 +20799,28 @@ "description": "A security configuration was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -14151,15 +20835,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -14177,16 +20854,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14196,18 +20886,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -14216,16 +20919,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14235,15 +20951,28 @@ "description": "An agreement for invoiced billing for GitHub Sponsors was signed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -14255,15 +20984,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -14273,15 +21015,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -14290,17 +21047,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -14309,17 +21079,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -14328,16 +21112,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -14347,14 +21144,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -14364,17 +21176,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -14382,18 +21207,31 @@ "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", - "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", + "fields": [ "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -14402,18 +21240,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14422,15 +21273,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -14440,16 +21305,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14457,15 +21335,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -14476,16 +21367,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -14495,17 +21399,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -14516,17 +21433,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -14537,18 +21467,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14558,16 +21499,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14577,16 +21531,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14598,17 +21565,30 @@ "fields": [ "@timestamp", "_document_id", - "fingerprint", - "operation_type", - "openssh_public_key", - "org_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "request_id" + "fingerprint", + "operation_type", + "openssh_public_key", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -14617,19 +21597,32 @@ "description": "An SSH certificate authority for an organization or enterprise was deleted.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "created_at", + "@timestamp", "_document_id", - "fingerprint", - "operation_type", + "action", "actor", - "org_id", - "openssh_public_key", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", - "request_id" + "created_at", + "fingerprint", + "operation_type", + "openssh_public_key" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -14638,21 +21631,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "user", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "request_id", - "org", - "org_id", - "created_at", - "actor", "action", - "user_id", + "actor", + "actor_id", "business", "business_id", - "@timestamp", - "actor_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -14661,19 +21663,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "actor_id", - "user_id", - "org", - "operation_type", - "request_id", "@timestamp", "_document_id", - "actor", - "user", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -14682,15 +21695,28 @@ "description": "Dependabot encrypted config was read.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "public_repo" @@ -14701,20 +21727,34 @@ "description": "The verification code expiry time for an organization or enterprise domain was set.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "token_expires_at", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14722,18 +21762,33 @@ "description": "An organization or enterprise domain was unverified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ] }, { @@ -14741,16 +21796,31 @@ "description": "An organization or enterprise domain was verified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "domain_name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14758,23 +21828,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14782,23 +21862,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14806,23 +21896,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14830,23 +21930,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14854,21 +21964,31 @@ "description": "A member of an organization was added to a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", "fields": [ - "user_agent", - "request_id", - "org_id", - "user_id", - "team", - "user", "@timestamp", - "actor_id", - "created_at", - "operation_type", "_document_id", - "org", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" @@ -14878,22 +21998,31 @@ "description": "A team was given access and permissions to a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "team", - "action", - "operation_type", - "request_id", - "created_at", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "actor_id", - "_document_id", "repo_id", - "user_agent", - "org_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -14902,20 +22031,31 @@ "description": "A child team was created or a child team's parent was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", "fields": [ - "org", "@timestamp", - "created_at", "_document_id", - "team", "action", - "operation_type", "actor", - "request_id", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", + "operation_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" }, @@ -14924,18 +22064,31 @@ "description": "A team's privacy level was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", "fields": [ - "user_agent", - "request_id", - "org", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", "created_at", "operation_type", - "actor_id", - "org_id", - "@timestamp", - "actor", - "_document_id", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" @@ -14945,21 +22098,32 @@ "description": "A new team is created.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "oauth_application_id", + "operation_type", "team", - "org", - "actor", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "team_type" ] }, @@ -14968,21 +22132,31 @@ "description": "A user was demoted from a team maintainer to a team member.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" }, @@ -14991,19 +22165,31 @@ "description": "A team was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "team", "org_id", - "actor_id", - "actor", - "action", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", "operation_type", - "_document_id", - "programmatic_access_type", "team_type" ] }, @@ -15012,19 +22198,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "business_id", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", "actor_id", - "user", "business", - "action", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15032,19 +22229,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "operation_type", - "request_id", "actor", - "org", - "created_at", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", - "_document_id" + "operation_type", + "created_at" ] }, { @@ -15052,18 +22260,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", "@timestamp", - "action", "_document_id", - "user_agent", - "user_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business", + "user_id", + "user_agent", "operation_type", - "actor", "created_at" ] }, @@ -15072,19 +22291,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "actor", - "action", - "operation_type", - "team", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "team" ] }, { @@ -15092,19 +22323,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", "@timestamp", - "actor_id", "_document_id", - "team", - "created_at", - "org_id", "action", - "request_id", - "user_agent", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_access_security_header" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "team", + "created_at" ] }, { @@ -15112,22 +22355,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "team", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at" ] }, { @@ -15135,22 +22387,31 @@ "description": "A user was promoted from a team member to a team maintainer.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" }, @@ -15159,22 +22420,31 @@ "description": "An organization member was removed from a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", "fields": [ - "request_id", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "team", - "user_id", - "actor", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", + "user_id", "user_agent", - "_document_id", - "token_scopes", - "programmatic_access_type", + "operation_type", + "created_at", + "team", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" @@ -15182,23 +22452,33 @@ { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A", - "fields": [ - "request_id", - "org_id", - "repo", - "repo_id", - "action", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "created_at", "team", - "org", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -15206,21 +22486,32 @@ "description": "A team's name was changed.", "docs_reference_links": "N/A", "fields": [ - "name", - "user_agent", - "created_at", - "team", - "operation_type", - "actor_id", - "org", + "@timestamp", + "_document_id", "action", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "_document_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "team", + "operation_type", "team_type" ] }, @@ -15229,17 +22520,30 @@ "description": "Team synchronization with a tenant was disabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "request_id", - "org_id", "actor_id", - "operation_type", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -15248,19 +22552,30 @@ "description": "Team synchronization with a tenant was enabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ - "org_id", - "business_id", - "actor", - "created_at", - "user_agent", "@timestamp", - "operation_type", - "business", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -15269,19 +22584,30 @@ "description": "The Okta credentials for team synchronization with a tenant were changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -15289,28 +22615,37 @@ "description": "A team's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "team", - "org_id", "@timestamp", - "org", "_document_id", - "old_permission", - "request_id", - "repo", "action", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "old_permission", "operation_type", "created_at", - "user_agent", "permission", "new_repo_permission", "new_repo_base_role", "old_repo_permission", - "old_repo_base_role", - "token_scopes", - "programmatic_access_type" + "old_repo_base_role" ] }, { @@ -15318,16 +22653,30 @@ "description": "A Dependabot rule was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15337,16 +22686,30 @@ "description": "A Dependabot rule was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15356,18 +22719,31 @@ "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15377,21 +22753,33 @@ "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -15399,21 +22787,32 @@ "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -15421,21 +22820,32 @@ "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -15443,16 +22853,30 @@ "description": "A Dependabot rule's conditions, actions, or metadata changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15462,27 +22886,33 @@ "description": "A workflow job was approved.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", - "repo", - "repo_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -15491,23 +22921,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -15515,10 +22955,28 @@ "description": "A workflow run was cancelled.", "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -15529,20 +22987,9 @@ "run_number", "cancelled_at", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Canceling a workflow run" }, @@ -15551,23 +22998,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15577,10 +23032,28 @@ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -15592,19 +23065,9 @@ "conclusion", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -15615,10 +23078,28 @@ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -15627,21 +23108,10 @@ "head_branch", "head_sha", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "public_repo", - "programmatic_access_type", "actor_is_bot", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "Understanding GitHub Actions" @@ -15651,23 +23121,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -15676,22 +23158,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15699,21 +23192,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -15721,25 +23225,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15747,23 +23259,36 @@ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", "fields": [ - "repo_id", - "repo", - "org_id", - "org", - "business_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "job_name", "runner_labels", "is_hosted_runner", "environment_name", "secrets_passed", - "action", - "_document_id", "operation_type", "created_at", - "@timestamp", "runner_owner_type", "job_workflow_ref", "calling_workflow_refs", @@ -15777,24 +23302,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -15803,10 +23337,28 @@ "description": "A workflow run was re-run.", "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -15816,21 +23368,11 @@ "head_sha", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", "rerun_type", "check_run_id", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "Re-running workflows and jobs" @@ -15840,25 +23382,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.15/user.json b/src/audit-logs/data/ghes-3.15/user.json index f302c013870a..8f6a88ea4bc6 100644 --- a/src/audit-logs/data/ghes-3.15/user.json +++ b/src/audit-logs/data/ghes-3.15/user.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,17 +67,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "request_id", "@timestamp", - "user_agent", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", - "user_id", + "token_scopes", "user", - "actor", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -61,18 +98,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", + "token_scopes", "user", - "request_id", - "_document_id", - "user_agent", - "actor", "user_id", - "actor_id", - "operation_type", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -80,18 +129,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "actor_id", - "operation_type", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "token_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -99,29 +160,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -129,18 +196,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -148,17 +227,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -167,19 +259,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -188,18 +292,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -207,18 +324,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -226,15 +355,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -244,17 +386,30 @@ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "created_at", "operation_type" ], @@ -265,20 +420,32 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -287,19 +454,32 @@ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "limit", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -308,19 +488,31 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -329,20 +521,32 @@ "description": "The policy for fork pull request workflows was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -351,19 +555,31 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -372,20 +588,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -394,20 +621,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -418,17 +656,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -436,14 +686,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -453,25 +718,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -482,22 +756,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -509,22 +794,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -533,15 +829,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -552,17 +863,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -572,27 +896,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "org", "owner", "pull_request_id", "machine_type", - "user_id", - "user", "devcontainer_path", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -600,38 +933,63 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "owner", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" - ] - }, - { - "action": "codespaces.trusted_repositories_access_update", - "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", - "fields": [ - "user_agent", - "request_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", + "operation_type", "created_at", - "_document_id" + "public_repo" + ] + }, + { + "action": "codespaces.trusted_repositories_access_update", + "description": "A personal account's access and security setting for Codespaces were updated.", + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -640,23 +998,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -664,16 +1029,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -682,24 +1061,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -707,15 +1092,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -725,20 +1123,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -746,19 +1154,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -766,65 +1186,92 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "business", - "business_id" - ] - }, - { - "action": "custom_hosted_runner.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "name", - "runner_group_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] }, { - "action": "custom_hosted_runner.destroy", + "action": "custom_hosted_runner.create", "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", + "created_at", + "operation_type" + ] + }, + { + "action": "custom_hosted_runner.destroy", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -834,21 +1281,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -858,19 +1314,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -879,19 +1346,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -900,19 +1378,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -921,19 +1410,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -942,17 +1442,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -960,19 +1473,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -981,39 +1505,61 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" - ] - }, - { - "action": "dependabot_security_updates_new_repos.disable", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1022,19 +1568,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1042,19 +1599,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1063,19 +1631,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1083,19 +1662,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1104,20 +1694,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1125,22 +1725,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1149,22 +1758,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1172,28 +1791,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "business", "business_id", - "public_repo", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "visibility", + "operation_type", + "created_at", + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1202,27 +1827,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -1231,25 +1864,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1258,26 +1899,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1286,21 +1934,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1309,22 +1969,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1333,25 +2003,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1360,22 +2039,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1384,23 +2075,33 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", - "new_value", - "approvers_was", - "approvers", "programmatic_access_type", - "can_admins_bypass", - "prevent_self_review" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "new_value", + "approvers_was", + "approvers", + "can_admins_bypass", + "prevent_self_review" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1409,21 +2110,32 @@ "description": "A gist was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "gist_id", - "@timestamp", "created_at", "operation_type", - "user_agent", - "actor", - "actor_id", - "visibility", - "action", - "_document_id", - "token_scopes", - "programmatic_access_type" + "visibility" ] }, { @@ -1431,20 +2143,32 @@ "description": "A gist was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "gist_id", - "visibility", - "created_at", + "@timestamp", "_document_id", - "user", - "request_id", - "operation_type", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "@timestamp", - "programmatic_access_type" + "gist_id", + "visibility", + "created_at", + "operation_type" ] }, { @@ -1452,21 +2176,32 @@ "description": "The visibility of a gist was updated.", "docs_reference_links": "N/A", "fields": [ - "action", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", - "user", - "gist_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "visibility", - "user_id", - "created_at", - "_document_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "gist_id", + "visibility", + "created_at" ] }, { @@ -1474,22 +2209,33 @@ "description": "An SSH key was added to a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -1498,23 +2244,34 @@ "description": "An SSH key was removed from a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", "explanation", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -1523,23 +2280,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1547,18 +2313,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1569,20 +2345,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1592,37 +2378,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "created_at", - "user_id", "@timestamp", - "user", - "operation_type", "_document_id", - "actor", "action", - "user_agent", - "request_access_security_header" - ] - }, - { - "action": "gpg_key.destroy", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "gpg_key.destroy", "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "created_at", - "_document_id", + "user_id", "user_agent", - "@timestamp", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -1630,25 +2440,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -1656,25 +2476,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -1682,26 +2511,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -1710,25 +2548,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -1736,26 +2583,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -1763,21 +2619,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -1786,41 +2653,65 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "actor_id", - "request_id", "@timestamp", - "name", - "integration", - "user", "_document_id", "action", - "operation_type", - "created_at", - "user_agent" - ] - }, - { - "action": "integration.generate_client_secret", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", "operation_type", + "created_at" + ] + }, + { + "action": "integration.generate_client_secret", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -1829,19 +2720,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -1852,20 +2757,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -1875,24 +2792,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -1903,23 +2831,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -1930,20 +2870,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -1953,19 +2906,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -1974,20 +2941,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -1997,20 +2977,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -2019,20 +3012,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -2041,20 +3047,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -2062,19 +3080,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2083,19 +3114,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2104,17 +3148,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2127,21 +3184,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -2155,17 +3225,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2177,18 +3260,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2196,43 +3291,69 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", - "user_id", - "user_agent", - "operation_type", - "created_at", - "request_id", + "action", + "actor", "actor_id", - "marketplace_listing", - "integration", - "action" - ] - }, - { + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "secondary_category", + "primary_category", + "operation_type", + "created_at", + "marketplace_listing", + "integration" + ] + }, + { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -2240,22 +3361,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -2263,19 +3397,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -2286,21 +3433,36 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "actor", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", "marketplace_listing", "has_free_trial", - "user_agent", - "request_id", - "actor_id", "yearly_price_in_cents", "description", "bullets", "monthly_price_in_cents", - "marketplace_listing_plan", - "_document_id" + "marketplace_listing_plan" ] }, { @@ -2308,22 +3470,37 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "marketplace_listing_plan", "marketplace_listing", "description", "bullets", "has_free_trial", "created_at", - "actor_id", "operation_type", - "_document_id", - "action", - "user_agent", - "request_id", - "actor", "monthly_price_in_cents", - "yearly_price_in_cents", - "@timestamp" + "yearly_price_in_cents" ] }, { @@ -2331,21 +3508,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor", - "marketplace_listing_plan", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "marketplace_listing_plan", "description", "yearly_price_in_cents", - "@timestamp", "created_at", - "actor_id", "bullets", "has_free_trial", "marketplace_listing", - "user_agent", "monthly_price_in_cents", - "action", "operation_type" ] }, @@ -2354,21 +3546,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "monthly_price_in_cents", - "marketplace_listing", + "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "monthly_price_in_cents", + "marketplace_listing", "description", "bullets", "yearly_price_in_cents", - "request_id", - "actor_id", "has_free_trial", "marketplace_listing_plan", - "user_agent", - "@timestamp", "operation_type", - "actor", "created_at" ] }, @@ -2377,22 +3584,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -2400,22 +3620,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2423,19 +3656,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2443,21 +3688,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2467,16 +3721,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2486,18 +3753,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2507,14 +3787,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -2522,19 +3818,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -2542,18 +3849,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2561,23 +3880,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -2585,20 +3912,30 @@ "description": "An OAuth access token was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", "fields": [ - "_document_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "user", - "user_id", - "created_at", + "_document_id", "action", + "actor", "actor_id", - "request_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" @@ -2609,19 +3946,30 @@ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", "fields": [ "@timestamp", - "user_agent", - "action", - "operation_type", "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_id", + "user_agent", + "operation_type", + "created_at", "explanation", - "hashed_token", - "actor_id", - "token_scopes", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" @@ -2631,19 +3979,30 @@ "description": "An OAuth access token was regenerated.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "_document_id", - "created_at", "@timestamp", - "operation_type", + "_document_id", "action", - "user_agent", - "request_id", "actor", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "oauth_application_name" ] }, @@ -2652,18 +4011,30 @@ "description": "An OAuth access token was updated.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -2671,20 +4042,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2693,20 +4076,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2715,20 +4110,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2737,20 +4144,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2759,19 +4178,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2780,20 +4212,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2802,20 +4246,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2824,19 +4280,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2845,24 +4314,31 @@ "description": "An authorization for an OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ - "operation_type", - "user_agent", - "user_id", - "actor", - "org_id", + "@timestamp", "_document_id", - "request_id", "action", - "@timestamp", - "created_at", + "actor", "actor_id", - "user", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_is_bot", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -2872,20 +4348,31 @@ "description": "An authorization for an OAuth application was deleted.", "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", "fields": [ - "user_agent", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "actor", "created_at", "explanation", - "user", - "user_id", - "org_id", - "action", - "actor_id", - "token_scopes", "actor_is_bot", "oauth_application_name" ], @@ -2896,21 +4383,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -2919,24 +4416,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2944,20 +4451,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -2965,22 +4482,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -2988,20 +4513,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -3009,22 +4544,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -3032,21 +4575,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3054,26 +4606,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3081,28 +4641,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3110,26 +4678,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3137,20 +4713,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -3159,16 +4746,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -3179,18 +4779,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -3199,18 +4812,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -3219,18 +4844,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -3239,18 +4877,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -3260,20 +4910,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -3281,17 +4942,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -3301,20 +4975,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -3323,20 +5008,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -3345,17 +5044,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3366,20 +5080,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -3388,19 +5116,31 @@ "description": "A new passkey was added.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3408,19 +5148,31 @@ "description": "A new passkey was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3428,18 +5180,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3447,16 +5211,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3464,18 +5242,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -3483,18 +5273,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3505,18 +5308,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3527,17 +5343,30 @@ "description": "Triggered when you create a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3547,19 +5376,31 @@ "description": "Triggered when you regenerate a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3567,12 +5408,29 @@ "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", "fields": [ - "user_programmatic_access_name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", "operation_type" ], @@ -3583,20 +5441,32 @@ "description": "Triggered when you delete a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "explanation", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3604,17 +5474,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -3625,18 +5508,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -3648,17 +5544,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -3670,17 +5579,30 @@ "description": "A fine-grained personal access token was updated.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3691,15 +5613,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3709,17 +5646,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -3729,15 +5677,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3747,17 +5710,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -3767,17 +5741,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -3787,17 +5772,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -3807,17 +5803,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -3827,17 +5834,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", - "request_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -3847,17 +5867,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3865,20 +5898,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -3888,25 +5932,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -3914,20 +5970,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3935,25 +6003,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3961,17 +6041,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -3979,17 +6072,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -3997,18 +6103,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -4017,18 +6135,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -4037,19 +6167,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -4057,17 +6198,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -4079,22 +6233,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -4102,19 +6265,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -4122,17 +6296,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4140,18 +6327,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -4159,20 +6359,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4180,18 +6390,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -4200,18 +6422,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -4220,17 +6454,30 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", + "created_at", "operation_type", "project_kind", "project_name" @@ -4241,21 +6488,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -4263,18 +6522,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4285,23 +6557,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -4310,24 +6593,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -4336,20 +6630,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4358,21 +6666,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -4382,22 +6703,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4406,25 +6739,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4433,23 +6776,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", "key", "fingerprint", - "actor_id", - "actor", "title", - "user_agent", - "user_id", - "request_id", - "read_only", - "token_scopes", - "programmatic_access_type" + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4458,22 +6812,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -4482,21 +6846,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -4505,25 +6878,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -4532,23 +6912,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -4557,24 +6945,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -4583,23 +6978,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -4609,22 +7012,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -4633,19 +7045,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -4654,24 +7079,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -4680,23 +7115,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4707,17 +7151,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -4726,15 +7183,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -4745,16 +7215,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -4764,17 +7247,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -4784,19 +7280,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -4805,17 +7312,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -4824,26 +7344,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -4852,30 +7378,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ - "repo", - "user_id", - "visibility", - "repo_id", - "user", - "request_id", - "actor_id", - "action", - "operation_type", - "request_category", "@timestamp", - "created_at", "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "oauth_application_id", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "request_category", + "created_at", + "oauth_application_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -4885,20 +7416,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -4907,25 +7449,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -4934,23 +7484,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -4958,25 +7519,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -4986,23 +7556,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -5010,21 +7590,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -5032,21 +7622,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -5054,22 +7654,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -5077,21 +7686,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -5099,20 +7718,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -5120,22 +7750,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -5143,18 +7782,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5162,22 +7815,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5185,21 +7848,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -5207,18 +7880,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -5227,22 +7912,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5251,49 +7945,67 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", - "repo", - "repo_id", - "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "request_access_security_header" - ], - "docs_reference_titles": "Store information in variables" - }, - { + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "public_repo", + "created_at", + "operation_type" + ], + "docs_reference_titles": "Store information in variables" + }, + { "action": "repo.remove_integration_secret", "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -5301,26 +8013,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -5329,21 +8046,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -5352,25 +8078,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -5378,22 +8110,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -5402,19 +8144,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -5422,23 +8175,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -5448,20 +8210,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -5472,21 +8245,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -5495,22 +8279,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -5519,21 +8313,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -5542,22 +8347,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -5568,16 +8383,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -5586,22 +8412,31 @@ "description": "Temporary access was enabled for a repository.", "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing user-owned repositories in your enterprise" }, @@ -5611,22 +8446,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -5635,23 +8481,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -5661,19 +8517,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -5681,22 +8547,32 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" - ], + "user_agent", + "operation_type", + "created_at", + "visibility" + ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, { @@ -5704,24 +8580,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -5729,25 +8614,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5756,24 +8648,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -5782,25 +8684,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5809,22 +8719,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -5833,26 +8752,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -5860,31 +8787,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -5893,21 +8827,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -5915,21 +8859,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -5937,21 +8891,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -5959,20 +8924,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -5980,21 +8957,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -6002,19 +8990,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -6022,31 +9023,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -6055,19 +9064,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -6075,8 +9095,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -6085,23 +9104,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -6126,18 +9154,30 @@ "description": "A security key was registered for an account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "created_at", - "user_id", - "action", - "operation_type", - "request_id", "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -6145,18 +9185,30 @@ "description": "A security key was removed from an account.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "operation_type", - "_document_id", - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6164,16 +9216,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6183,18 +9248,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -6203,16 +9281,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6223,15 +9314,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -6241,15 +9345,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -6258,17 +9377,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -6277,17 +9409,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -6296,16 +9442,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -6315,14 +9474,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -6332,36 +9506,62 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", - "user", - "operation_type", - "@timestamp", - "created_at", "actor_id", - "_document_id" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" - }, - { + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + }, + { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -6370,18 +9570,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6390,15 +9603,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -6408,16 +9635,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6425,15 +9665,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -6444,16 +9697,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -6463,17 +9729,30 @@ "description": "Triggered when you send an email update to your sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", "fields": [ - "request_id", - "actor", - "action", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" }, @@ -6482,17 +9761,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -6503,17 +9795,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -6524,18 +9829,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6545,16 +9861,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6564,17 +9893,30 @@ "description": "You join the waitlist to join GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "actor_id", - "action", "operation_type", - "created_at", - "user", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -6583,16 +9925,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6602,23 +9957,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6626,23 +9991,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6650,23 +10025,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6674,23 +10059,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6698,15 +10093,30 @@ "description": "Triggered when you accept a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6715,32 +10125,62 @@ "description": "Triggered when you cancel a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ], - "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" - }, - { - "action": "successor_invitation.create", - "description": "Triggered when you create a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", - "fields": [ - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" + }, + { + "action": "successor_invitation.create", + "description": "Triggered when you create a succession invitation.", + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6749,15 +10189,30 @@ "description": "Triggered when you decline a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6766,15 +10221,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6782,15 +10252,30 @@ "description": "Triggered when you revoke a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6799,17 +10284,30 @@ "description": "A new trusted device was added.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6817,17 +10315,30 @@ "description": "A trusted device was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6835,14 +10346,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "action", - "request_id", - "user_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -6851,15 +10377,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "created_at", - "user_id", - "operation_type", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action" + "created_at", + "operation_type" ] }, { @@ -6867,13 +10408,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "created_at", - "user_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6881,17 +10439,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "operation_type", - "action", - "_document_id" + "created_at", + "operation_type" ] }, { @@ -6899,17 +10470,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user", - "created_at", - "request_id", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -6917,16 +10501,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6934,15 +10532,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_id", - "action", "@timestamp", - "created_at", - "user_agent", - "user", "_document_id", - "request_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6950,18 +10563,30 @@ "description": "A secondary authentication factor was added to a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -6970,18 +10595,30 @@ "description": "Two-factor authentication was disabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", "fields": [ - "actor", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor_id", + "user_agent", "created_at", - "operation_type", - "request_id", - "@timestamp", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Disabling two-factor authentication for your personal account" }, @@ -6990,18 +10627,30 @@ "description": "Two-factor authentication was enabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ - "actor", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Configuring two-factor authentication" }, @@ -7010,15 +10659,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user", - "user_id", - "action", "@timestamp", - "request_id", "_document_id", - "user_agent" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7026,16 +10690,29 @@ "description": "Two factor recovery codes were regenerated for a user account.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", + "operation_type", "created_at" ] }, @@ -7044,18 +10721,30 @@ "description": "A secondary authentication factor was removed from a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -7064,15 +10753,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "operation_type", - "user_id", - "user", - "user_agent", - "created_at", + "@timestamp", "_document_id", "action", - "@timestamp" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7081,16 +10785,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "operation_type", "user_agent", - "action", - "request_id", - "actor", - "actor_id" + "created_at", + "operation_type" ] }, { @@ -7098,19 +10815,31 @@ "description": "An email address was added to a user account.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", "operation_type", - "_document_id", - "actor_id", - "actor", "email", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding an email address to your GitHub account" }, @@ -7119,18 +10848,30 @@ "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "created_at", - "user", "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -7138,15 +10879,28 @@ "description": "Audit log entries were exported.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "action", - "request_id", - "actor", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", "created_at" ] @@ -7156,20 +10910,31 @@ "description": "A user was blocked by another user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_id", - "_document_id", "actor_id", - "@timestamp", - "user_agent", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -7177,18 +10942,30 @@ "description": "A user changed their password.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "actor_id", - "operation_type", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "created_at", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7196,18 +10973,30 @@ "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -7216,17 +11005,30 @@ "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -7235,19 +11037,31 @@ "description": "A new user account was created.", "docs_reference_links": "N/A", "fields": [ - "email", - "user_id", - "operation_type", "@timestamp", - "request_id", - "user", - "created_at", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "action", - "programmatic_access_type" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "email", + "operation_type", + "created_at" ] }, { @@ -7255,21 +11069,33 @@ "description": "A user secret for Codespaces was created.", "docs_reference_links": "N/A", "fields": [ - "actor", - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7277,20 +11103,31 @@ "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "user_agent", + "@timestamp", "_document_id", - "operation_type", - "oauth_application_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "@timestamp", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -7298,18 +11135,30 @@ "description": "A user account was destroyed by an asynchronous job.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "request_id", - "user_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7318,19 +11167,30 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "oauth_application_id", + "_document_id", "action", - "user", - "created_at", - "user_agent", - "request_id", "actor", "actor_id", - "operation_type", - "_document_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", + "operation_type" ] }, { @@ -7338,18 +11198,30 @@ "description": "A user deleted his or her account, triggering user.async_delete.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", - "created_at", - "user_agent", "user_id", - "operation_type", - "actor_id", - "action", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7357,18 +11229,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "user_agent", "user_id", - "actor_id", - "action", - "operation_type", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7376,18 +11260,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "operation_type", - "created_at", - "_document_id", - "@timestamp", - "user", - "actor_id", - "action", - "request_access_security_header" + "created_at" ] }, { @@ -7396,17 +11292,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user", "_document_id", "action", - "operation_type", - "user_agent", - "created_at", - "request_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7414,17 +11322,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7432,35 +11353,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ] - }, + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, { "action": "user.disable_sockpuppet_disallowed", "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7468,21 +11415,31 @@ "description": "An enterprise managed user claimed an email address.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7490,21 +11447,31 @@ "description": "N/A", "docs_reference_links": "An enterprise managed user unclaimed an email address.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." }, @@ -7513,17 +11480,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7531,17 +11511,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7549,17 +11542,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7567,18 +11573,30 @@ "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "action", - "operation_type", - "request_id", - "created_at", - "_document_id", "@timestamp", - "user", - "org_id", + "_document_id", + "action", "actor", "actor_id", - "user_agent" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7586,17 +11604,31 @@ "description": "A user requested a password reset.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", "fields": [ - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "email", - "created_at", - "user_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" }, @@ -7605,17 +11637,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "created_at", - "user_agent", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor", - "operation_type", - "request_id" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7623,18 +11668,30 @@ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -7643,19 +11700,31 @@ "description": "A user signed in.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "actor_id", "@timestamp", - "user", - "action", - "operation_type", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "actor", - "passkey_nickname", - "request_access_security_header" + "passkey_nickname" ] }, { @@ -7663,18 +11732,30 @@ "description": "A user signed out.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7682,18 +11763,30 @@ "description": "A user signed in from a new device.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7701,21 +11794,31 @@ "description": "An ordinary user account was promoted to a site administrator.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", + "user_id", "user_agent", + "created_at", "oauth_application_id", - "request_id", - "operation_type", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7723,16 +11826,29 @@ "description": "A user's account was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user", - "action", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "actor", "operation_type" ] }, @@ -7741,20 +11857,31 @@ "description": "An email address was removed from a user account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "actor", - "actor_id", "created_at", - "email", - "token_scopes", - "programmatic_access_type" + "email" ] }, { @@ -7762,20 +11889,32 @@ "description": "A user secret for Codespaces was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "key", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "key", + "integration", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7783,20 +11922,31 @@ "description": "A username was changed.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "request_id", - "actor_id", - "old_login", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "operation_type", "user_agent", - "token_scopes", - "programmatic_access_type" + "old_login", + "created_at", + "operation_type" ] }, { @@ -7804,18 +11954,30 @@ "description": "A user reset their account password.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "@timestamp", - "_document_id", - "actor", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7823,16 +11985,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_id", - "action", "@timestamp", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -7843,16 +12018,28 @@ "fields": [ "@timestamp", "_document_id", - "request_id", - "user_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor_id", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -7861,18 +12048,30 @@ "description": "A user signed in from an unrecognized device.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "created_at", - "actor", - "actor_id", - "@timestamp", - "request_access_security_header" + "created_at" ] }, { @@ -7880,18 +12079,30 @@ "description": "A user signed in from an unrecognized device and location.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "created_at", - "_document_id", - "request_id", - "action", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7899,22 +12110,33 @@ "description": "Triggered when you clear the status on your profile.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "message", - "user", - "actor_id", "created_at", - "request_id", "limited_availability", - "action", "emoji", - "operation_type", - "user_agent", - "@timestamp", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -7922,23 +12144,33 @@ "description": "Triggered when you set or change the status on your profile.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", "fields": [ - "limited_availability", - "user", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "message", - "user_id", - "created_at", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "limited_availability", + "message", + "created_at", "emoji", - "org", - "actor", - "operation_type", - "token_scopes", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Personalize your profile" }, @@ -7947,21 +12179,31 @@ "description": "A user account was suspended.", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", - "operation_type", - "actor_id", - "user", - "user_agent", - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", - "user_id", + "_document_id", "action", - "token_scopes", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -7969,18 +12211,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", - "actor_id", "@timestamp", - "operation_type", "_document_id", - "user_agent", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7988,18 +12242,30 @@ "description": "A 2FA challenge issued for a user account failed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "_document_id", - "user_agent", - "user", - "actor_id", - "actor", - "user_id", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8009,35 +12275,59 @@ "fields": [ "@timestamp", "_document_id", - "user_id", - "operation_type", - "actor_id", - "user", - "actor", - "user_agent", - "request_id", "action", - "created_at", - "request_access_security_header" - ] - }, + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, { "action": "user.two_factor_recover", "description": "A user used their 2FA recovery codes.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "user_agent", - "request_id", - "user", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "created_at", - "@timestamp", - "_document_id", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8045,18 +12335,30 @@ "description": "A user downloaded 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8064,17 +12366,30 @@ "description": "A user printed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", - "user_agent", - "request_id", - "user_id", - "created_at", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8082,18 +12397,30 @@ "description": "A user viewed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", "created_at", - "user", - "operation_type", - "@timestamp", - "request_id", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -8101,17 +12428,30 @@ "description": "A user was prompted for a two-factor authentication code.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", "fields": [ - "user", - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "actor" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" }, @@ -8120,19 +12460,31 @@ "description": "A user was unblocked by another user.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "actor", - "@timestamp", - "user_agent", - "user_id", - "user", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -8140,21 +12492,31 @@ "description": "A user account was unsuspended.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", - "user", "action", - "user_agent", "actor", - "oauth_application_id", - "operation_type", "actor_id", - "created_at", - "@timestamp", - "user_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -8162,21 +12524,33 @@ "description": "A user secret for Codespaces was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8184,46 +12558,64 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", + "operation_type" + ] + }, + { + "action": "workflows.approve_workflow_job", + "description": "A workflow job was approved.", + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" - ] - }, - { - "action": "workflows.approve_workflow_job", - "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", - "fields": [ "user_agent", - "request_id", - "actor", - "actor_id", "workflow_run_id", "run_number", - "user", - "user_id", - "repo", - "repo_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -8232,23 +12624,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8256,23 +12658,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8282,23 +12692,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -8307,22 +12729,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8330,21 +12763,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -8352,25 +12796,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8378,24 +12830,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -8404,25 +12865,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.16/enterprise.json b/src/audit-logs/data/ghes-3.16/enterprise.json index 3baff923869f..ba6d85fc78da 100644 --- a/src/audit-logs/data/ghes-3.16/enterprise.json +++ b/src/audit-logs/data/ghes-3.16/enterprise.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,17 +67,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "request_id", "@timestamp", - "user_agent", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", - "user_id", + "token_scopes", "user", - "actor", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -61,18 +98,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", + "token_scopes", "user", - "request_id", - "_document_id", - "user_agent", - "actor", "user_id", - "actor_id", - "operation_type", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -80,18 +129,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "actor_id", - "operation_type", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "token_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -99,29 +160,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -129,31 +196,34 @@ "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests", "fields": [ - "user_agent", - "request_id", - "request_method", - "query_string", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", - "request_body", - "status_code", - "url_path", "business", "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "request_method", + "query_string", + "request_body", + "status_code", + "url_path", + "public_repo", "created_at", "operation_type", "route", @@ -167,18 +237,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -186,20 +268,32 @@ "description": "A manual check of the endpoint configured for audit log streaming was performed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "audit_log_stream_result", - "business_id", "business", - "action", - "_document_id", - "@timestamp", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_result", "created_at", "operation_type", - "audit_log_stream_sink_details", - "request_access_security_header" + "audit_log_stream_sink_details" ] }, { @@ -207,18 +301,31 @@ "description": "An endpoint was added for audit log streaming.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "business_id", "business", - "audit_log_stream_sink", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_sink", + "created_at", + "operation_type", "audit_log_stream_id" ] }, @@ -227,15 +334,28 @@ "description": "An audit log streaming endpoint was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "business_id", "business", - "action", - "_document_id", - "@timestamp", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "audit_log_stream_id", @@ -247,17 +367,30 @@ "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "audit_log_stream_enabled", - "business_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_enabled", "audit_log_stream_sink", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "new_s3_bucket", @@ -280,17 +413,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -299,19 +445,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -320,18 +478,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -339,18 +510,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -358,15 +541,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -376,22 +572,31 @@ "description": "An enterprise owner was added to an enterprise.", "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", "fields": [ - "name", - "business", - "user", - "user_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "request_id", + "business", "business_id", - "_document_id", - "user_agent", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "operation_type" ], "docs_reference_titles": "Inviting people to manage your enterprise" }, @@ -400,22 +605,32 @@ "description": "An organization was added to an enterprise.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "operation_type", "name", "created_at", - "request_id", - "_document_id", - "business", - "organization_upgrade", - "request_access_security_header" + "organization_upgrade" ] }, { @@ -423,20 +638,30 @@ "description": "GitHub Advanced Security was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ - "actor", - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -445,17 +670,28 @@ "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -466,21 +702,31 @@ "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -489,17 +735,28 @@ "description": "GitHub Advanced Security was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -510,17 +767,28 @@ "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -531,21 +799,31 @@ "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -554,20 +832,32 @@ "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "new_policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "new_policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -576,20 +866,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -597,17 +899,28 @@ "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -619,21 +932,31 @@ "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -642,18 +965,31 @@ "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -662,17 +998,30 @@ "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", "fields": [ - "name", - "operation_type", - "business_id", - "user_agent", - "actor_id", - "request_id", - "actor", + "@timestamp", "_document_id", - "business", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -682,19 +1031,32 @@ "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", "business_id", - "action", - "_document_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "business", "visibility", "created_at", - "actor", - "operation_type", - "@timestamp" + "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -703,21 +1065,33 @@ "description": "The policy for Code scanning autofix was updated for an enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -725,21 +1099,33 @@ "description": "The policy for Code scanning autofix third party tools was updated for an enterprise.", "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/getting-started/github-security-features#available-with-github-code-security" }, @@ -748,19 +1134,31 @@ "description": "An enterprise was created.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", "_document_id", "action", - "@timestamp", - "request_id", - "name", + "actor", + "actor_id", "business", "business_id", - "operation_type", - "actor", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "name", + "operation_type", + "created_at" ] }, { @@ -768,17 +1166,28 @@ "description": "Dependabot alerts were disabled for new repositories in your enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -788,17 +1197,28 @@ "description": "Dependabot alerts were enabled for new repositories in your enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -808,17 +1228,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -828,18 +1261,30 @@ "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -847,17 +1292,28 @@ "description": "Display of IP addresses within audit log events for the enterprise was disabled.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", "fields": [ - "actor", - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -868,18 +1324,31 @@ "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.", "docs_reference_links": "N/A", "fields": [ - "action", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "business_id", - "actor_id", - "name", - "_document_id", - "request_id" + "name" ] }, { @@ -887,15 +1356,28 @@ "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -905,17 +1387,28 @@ "description": "Display of IP addresses within audit log events for the enterprise was enabled.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -926,18 +1419,31 @@ "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "operation_type", - "created_at", + "actor_id", "business", "business_id", - "name", - "_document_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "name" ] }, { @@ -945,20 +1451,31 @@ "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", "actor_id", - "@timestamp", - "request_id", "business", - "name", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "business_id", - "_document_id" + "created_at", + "name", + "operation_type" ] }, { @@ -966,20 +1483,31 @@ "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -987,20 +1515,31 @@ "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "name", - "actor", - "operation_type", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "business", - "actor_id", - "created_at", - "action", + "user_id", "user_agent", - "request_id", - "user_id" + "name", + "operation_type", + "created_at" ] }, { @@ -1008,20 +1547,31 @@ "description": "An enterprise owner was removed from an enterprise.", "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", - "user_agent", + "actor_id", "business", "business_id", - "@timestamp", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "name", - "actor_id", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", - "user" + "user_agent", + "operation_type", + "created_at", + "name" ], "docs_reference_titles": "Inviting people to manage your enterprise" }, @@ -1030,20 +1580,31 @@ "description": "An organization was removed from an enterprise.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "business", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "business_id", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "name", - "org" + "name" ] }, { @@ -1051,18 +1612,31 @@ "description": "The slug for the enterprise URL was renamed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "name", - "business_id", - "user_agent", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", - "@timestamp", - "created_at", + "actor_id", "business", - "_document_id" + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ] }, { @@ -1070,20 +1644,31 @@ "description": "The SAML single sign-on session for a member in an enterprise was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", - "user_agent", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "actor", - "_document_id", - "actor_id", "name", - "@timestamp", - "user_id", - "action", - "created_at", - "business" + "created_at" ] }, { @@ -1091,17 +1676,28 @@ "description": "Automatic partner validation checks have been disabled at the business level", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1112,17 +1708,28 @@ "description": "Automatic partner validation checks have been enabled at the business level", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1133,20 +1740,30 @@ "description": "An enterprise-level custom pattern was created for secret scanning.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -1155,17 +1772,28 @@ "description": "An enterprise-level custom pattern was removed from secret scanning.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1175,20 +1803,30 @@ "description": "An enterprise-level custom pattern was published for secret scanning.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1196,17 +1834,28 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1217,20 +1866,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -1239,17 +1898,28 @@ "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1259,17 +1929,28 @@ "description": "Secret scanning was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -1280,17 +1961,28 @@ "description": "Secret scanning was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1301,17 +1993,28 @@ "description": "Secret scanning was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1322,17 +2025,28 @@ "description": "Secret scanning was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1343,17 +2057,28 @@ "description": "Secret scanning for non-provider patterns was disabled at the enterprise level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1365,17 +2090,28 @@ "description": "Secret scanning for non-provider patterns was enabled at the enterprise level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1387,17 +2123,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1408,17 +2155,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1429,17 +2187,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1450,17 +2219,28 @@ "description": "Push protection for secret scanning was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1471,17 +2251,28 @@ "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1492,17 +2283,28 @@ "description": "Push protection for secret scanning was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -1513,17 +2315,28 @@ "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1534,20 +2347,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1555,26 +2380,36 @@ "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1582,24 +2417,34 @@ "description": "A CSV export was requested on the \"Coverage\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1607,26 +2452,36 @@ "description": "A CSV export was requested on the \"Overview Dashboard\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1634,20 +2489,31 @@ "description": "A CSV export was requested on the \"Risk\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1658,17 +2524,30 @@ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "created_at", "operation_type" ], @@ -1679,20 +2558,32 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1701,19 +2592,32 @@ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "limit", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1722,41 +2626,65 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "operation_type" + ], + "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" + }, + { "action": "business.set_fork_pr_workflows_policy", "description": "The policy for fork pull request workflows was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1765,19 +2693,31 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1786,20 +2726,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "issuer", - "name", - "user_agent", - "action", "@timestamp", "_document_id", + "action", "actor", + "actor_id", "business", "business_id", - "actor_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "issuer", + "name", + "created_at", + "operation_type" ] }, { @@ -1807,18 +2759,31 @@ "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "updated_github_owned_allowed", "updated_verified_allowed", "updated_patterns", @@ -1833,20 +2798,33 @@ "description": "The base repository permission setting was updated for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", "fields": [ - "business_id", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "permission", - "action", "created_at", - "@timestamp", - "request_id", "name", - "_document_id", - "old_permission", - "business" + "old_permission" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -1855,19 +2833,32 @@ "description": "The repository creation setting was updated for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation", "fields": [ - "created_at", + "@timestamp", "_document_id", - "request_id", - "name", - "business_id", + "action", "actor", "actor_id", - "@timestamp", - "operation_type", - "permission", - "action", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "name", + "operation_type", + "permission", "visibility" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -1877,19 +2868,32 @@ "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories", "fields": [ - "business_id", - "created_at", - "action", - "operation_type", "@timestamp", - "request_id", - "permission", + "_document_id", + "action", "actor", "actor_id", - "name", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "business" + "created_at", + "operation_type", + "permission", + "name" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -1898,20 +2902,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -1920,20 +2935,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -1944,17 +2970,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -1962,15 +3000,31 @@ "description": "Existing code scanning alerts appeared in a branch.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -1980,15 +3034,31 @@ "description": "Code scanning alerts were fixed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -1998,15 +3068,29 @@ "description": "Code scanning alerts were manually dismissed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers", "dismissal_approver_id" ], @@ -2017,13 +3101,31 @@ "description": "Code scanning alerts were seen for the first time.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2033,15 +3135,31 @@ "description": "Code scanning alerts that were previously fixed reappeared.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2051,15 +3169,29 @@ "description": "Code scanning alerts that were previously dismissed were reopened.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2069,14 +3201,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2086,25 +3233,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -2115,22 +3271,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -2142,22 +3309,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -2166,15 +3344,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -2185,17 +3378,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2205,27 +3411,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "org", "owner", "pull_request_id", "machine_type", - "user_id", - "user", "devcontainer_path", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2233,19 +3448,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -2253,18 +3481,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -2273,23 +3513,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2297,16 +3544,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -2315,24 +3576,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2340,15 +3607,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -2358,20 +3638,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2379,19 +3669,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -2399,21 +3701,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -2421,21 +3732,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2445,19 +3765,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -2467,21 +3796,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2491,18 +3829,31 @@ "description": "A new custom property definition was created.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -2515,18 +3866,31 @@ "description": "A custom property definition was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -2540,14 +3904,29 @@ "description": "A custom property definition was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "value_type", @@ -2560,8 +3939,7 @@ "old_default_value", "old_value_type", "old_values_editable_by", - "values_editable_by", - "request_access_security_header" + "values_editable_by" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2570,27 +3948,35 @@ "description": "A repository's custom property value was manually set for the first time.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2599,19 +3985,31 @@ "description": "A repository's custom property value was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2620,16 +4018,29 @@ "description": "A repository's custom property value was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "definition_id" @@ -2641,19 +4052,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -2662,19 +4084,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -2683,19 +4116,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -2704,19 +4148,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -2725,17 +4180,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2743,40 +4211,62 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependabot_security_updates.enable", - "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "created_at", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", + "user_agent", "operation_type", + "created_at" + ], + "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + }, + { + "action": "dependabot_security_updates.enable", + "description": "Dependabot security updates were enabled for all existing repositories.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "_document_id" + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2784,19 +4274,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -2805,19 +4306,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2825,19 +4337,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -2846,19 +4369,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2866,19 +4400,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -2887,20 +4432,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2908,21 +4463,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "team", - "created_at", - "user_id", "@timestamp", - "number", - "org", - "title", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", "user_agent", - "operation_type", - "_document_id" + "team", + "created_at", + "number", + "title", + "operation_type" ] }, { @@ -2930,18 +4497,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", "@timestamp", - "user_agent", - "operation_type", - "user_id", + "_document_id", + "action", "actor", - "number", - "user", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "number", + "created_at" ] }, { @@ -2949,18 +4529,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "action", - "_document_id", - "request_id", - "org", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org_id", "user_agent", - "actor", + "operation_type", "number", "team", "created_at" @@ -2971,21 +4562,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "_document_id", - "title", - "user", - "user_agent", - "org", - "operation_type", - "actor_id", "@timestamp", - "actor", - "team", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", + "title", + "operation_type", + "team", "number" ] }, @@ -2994,17 +4596,31 @@ "description": "A global announcement banner was created for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3015,16 +4631,30 @@ "description": "A global announcement banner was removed from the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3035,18 +4665,32 @@ "description": "A global announcement banner was updated for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", "old_message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3057,23 +4701,31 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise" }, @@ -3082,19 +4734,33 @@ "description": "A domain was approved for an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3103,18 +4769,33 @@ "description": "A domain was added to an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3123,18 +4804,33 @@ "description": "A domain was removed from an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3143,18 +4839,33 @@ "description": "A domain was verified for an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3163,18 +4874,30 @@ "description": "A new GitHub Actions self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -3183,20 +4906,30 @@ "description": "A GitHub Actions self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -3205,18 +4938,31 @@ "description": "A GitHub Actions self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows" ], "docs_reference_titles": "Removing self-hosted runners" @@ -3226,18 +4972,31 @@ "description": "A GitHub Actions self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3246,20 +5005,33 @@ "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -3268,19 +5040,31 @@ "description": "A GitHub Actions self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3289,19 +5073,32 @@ "description": "A GitHub Actions runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -3310,24 +5107,36 @@ "description": "The configuration of a GitHub Actions self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3336,30 +5145,66 @@ "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "business_id", - "runner_id", - "runner_name", - "action", + "@timestamp", "_document_id", - "operation_type", - "created_at", - "@timestamp" - ], - "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" - }, - { - "action": "enterprise.self_hosted_runner_online", - "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_id", + "runner_name", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" + }, + { + "action": "enterprise.self_hosted_runner_online", + "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -3368,18 +5213,36 @@ "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", "target_version", "runner_group_id", "runner_group_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Self-hosted runners" }, @@ -3388,22 +5251,32 @@ "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "business_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "user", - "business", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3411,21 +5284,33 @@ "description": "A license for GitHub Copilot was assigned to an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3433,17 +5318,30 @@ "description": "A license for GitHub Copilot was unassigned from an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3454,17 +5352,30 @@ "description": "A new enterprise team was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3474,17 +5385,30 @@ "description": "An enterprise team was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3495,22 +5419,32 @@ "description": "A member was removed from the enterprise team or an IdP group linked to an enterprise team, or an IdP group was unlinked from an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "business_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "user", - "business", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3518,18 +5452,31 @@ "description": "The name of an enterprise team was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "business_id", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3540,22 +5487,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3564,22 +5520,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3587,28 +5553,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3617,27 +5589,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -3646,25 +5626,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3673,26 +5661,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3701,21 +5696,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -3724,22 +5731,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3748,25 +5765,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3775,22 +5801,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -3799,21 +5837,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -3824,27 +5872,33 @@ "description": "A user was added to an external group.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "external_group", - "external_group_id", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "external_group", + "external_group_id", "created_at", "operation_type", - "business", - "business_id", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -3852,19 +5906,31 @@ "description": "An external group was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at", "scim_group_id" ] }, @@ -3873,22 +5939,33 @@ "description": "An external group was linked to a GitHub team.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "external_group", - "programmatic_access_type", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -3896,21 +5973,31 @@ "description": "An external group was created.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -3918,26 +6005,32 @@ "description": "A user was removed from an external group.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "external_group", - "external_group_id", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "external_group", + "external_group_id", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -3945,15 +6038,29 @@ "description": "Failed external group SCIM API request.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", @@ -3961,15 +6068,9 @@ "url_path", "scim_group_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -3978,30 +6079,38 @@ "description": "Successful external group SCIM API request. Excludes GET API requests.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", "status_code", "url_path", "scim_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4010,18 +6119,31 @@ "description": "An external group was unlinked to a GitHub team.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "external_group" ] }, @@ -4030,22 +6152,32 @@ "description": "An external group was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "scim_group_id", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at", + "scim_group_id" ] }, { @@ -4053,25 +6185,33 @@ "description": "An external group's display name was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", "external_group", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -4079,20 +6219,31 @@ "description": "An external identity was deprovisioned, suspending the linked GitHub user.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -4100,17 +6251,31 @@ "description": "An external identity was created and linked to a GitHub user.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "scim_user_id", - "request_access_security_header" + "scim_user_id" ] }, { @@ -4118,15 +6283,29 @@ "description": "Failed external identity SCIM API request.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", @@ -4134,15 +6313,9 @@ "url_path", "scim_user_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4151,30 +6324,38 @@ "description": "Successful external identity SCIM API request. Excludes GET API requests.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", "status_code", "url_path", "scim_user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4183,18 +6364,31 @@ "description": "An external identity was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "action", - "user_id", - "operation_type", "@timestamp", - "created_at", "_document_id", - "token_scopes", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "scim_user_id", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "scim_user_id" ] }, { @@ -4202,21 +6396,32 @@ "description": "A gist was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "gist_id", - "@timestamp", "created_at", "operation_type", - "user_agent", - "actor", - "actor_id", - "visibility", - "action", - "_document_id", - "token_scopes", - "programmatic_access_type" + "visibility" ] }, { @@ -4224,20 +6429,32 @@ "description": "A gist was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "gist_id", - "visibility", - "created_at", + "@timestamp", "_document_id", - "user", - "request_id", - "operation_type", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "@timestamp", - "programmatic_access_type" + "gist_id", + "visibility", + "created_at", + "operation_type" ] }, { @@ -4245,21 +6462,32 @@ "description": "The visibility of a gist was updated.", "docs_reference_links": "N/A", "fields": [ - "action", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", - "user", - "gist_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "visibility", - "user_id", - "created_at", - "_document_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "gist_id", + "visibility", + "created_at" ] }, { @@ -4267,19 +6495,30 @@ "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4288,20 +6527,30 @@ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4310,19 +6559,30 @@ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4331,22 +6591,33 @@ "description": "An SSH key was added to a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -4355,23 +6626,34 @@ "description": "An SSH key was removed from a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", "explanation", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -4380,42 +6662,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ] - }, - { - "action": "github_hosted_runner.destroy", - "description": "N/A", - "docs_reference_links": "N/A", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", + "created_at", + "operation_type" + ] + }, + { + "action": "github_hosted_runner.destroy", + "description": "N/A", + "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -4426,20 +6727,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -4449,18 +6760,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "created_at", - "user_id", "@timestamp", - "user", - "operation_type", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -4468,18 +6791,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "created_at", - "_document_id", + "user_id", "user_agent", - "@timestamp", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -4487,25 +6822,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -4513,25 +6858,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -4539,26 +6893,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -4567,25 +6930,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -4593,26 +6965,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", - "repo", - "operation_type", - "action", - "_document_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", + "operation_type", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -4620,21 +7001,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -4643,19 +7035,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -4663,21 +7068,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -4686,19 +7102,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -4709,20 +7139,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -4732,24 +7174,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -4760,23 +7213,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -4787,20 +7252,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -4810,19 +7288,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -4831,20 +7323,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -4854,20 +7359,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -4876,20 +7394,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -4898,20 +7429,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -4919,19 +7462,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -4940,19 +7496,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -4961,17 +7530,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -4984,21 +7566,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -5012,17 +7607,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ - "actor", - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -5034,19 +7642,30 @@ "description": "An IP allow list was disabled.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "actor", - "request_id", - "org", - "user_agent", + "@timestamp", "_document_id", - "user_id", + "action", + "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "@timestamp", - "user" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5054,19 +7673,30 @@ "description": "An IP allow list was disabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5074,17 +7704,28 @@ "description": "IP allow list user level enforcement was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5094,20 +7735,29 @@ "description": "An IP allow list was enabled.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "user_id", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "business_id", - "_document_id", - "action", - "@timestamp", + "user_id", "user_agent", - "actor_id", "operation_type", - "org", "created_at" ] }, @@ -5116,19 +7766,30 @@ "description": "An IP allow list was enabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5136,17 +7797,28 @@ "description": "IP allow list user level enforcement was enabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5156,24 +7828,32 @@ "description": "An IP address was added to an IP allow list.", "docs_reference_links": "N/A", "fields": [ - "active", - "org", - "ip_allow_list_entry", "@timestamp", "_document_id", - "operation_type", - "created_at", - "user_agent", "action", - "request_id", + "actor", "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "business", - "actor", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", + "ip_allow_list_entry", + "operation_type", + "created_at" ] }, { @@ -5181,24 +7861,32 @@ "description": "An IP address was deleted from an IP allow list.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "ip_allow_list_entry", - "org", - "operation_type", - "created_at", - "active", "action", - "@timestamp", + "actor", + "actor_id", "business", "business_id", - "user_agent", + "hashed_token", + "org", "org_id", - "actor", - "actor_id", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ip_allow_list_entry", + "operation_type", + "created_at", + "active" ] }, { @@ -5206,19 +7894,32 @@ "description": "An IP address or its description was changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "actor_id", "ip_allow_list_entry", - "active", - "org_id", - "@timestamp" + "active" ] }, { @@ -5226,18 +7927,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5245,21 +7958,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -5267,21 +7993,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -5289,22 +8028,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -5312,19 +8064,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -5335,21 +8100,36 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "actor", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", "marketplace_listing", "has_free_trial", - "user_agent", - "request_id", - "actor_id", "yearly_price_in_cents", "description", "bullets", "monthly_price_in_cents", - "marketplace_listing_plan", - "_document_id" + "marketplace_listing_plan" ] }, { @@ -5357,22 +8137,37 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "marketplace_listing_plan", "marketplace_listing", "description", "bullets", "has_free_trial", "created_at", - "actor_id", "operation_type", - "_document_id", - "action", - "user_agent", - "request_id", - "actor", "monthly_price_in_cents", - "yearly_price_in_cents", - "@timestamp" + "yearly_price_in_cents" ] }, { @@ -5380,21 +8175,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor", - "marketplace_listing_plan", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "marketplace_listing_plan", "description", "yearly_price_in_cents", - "@timestamp", "created_at", - "actor_id", "bullets", "has_free_trial", "marketplace_listing", - "user_agent", "monthly_price_in_cents", - "action", "operation_type" ] }, @@ -5403,45 +8213,73 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "monthly_price_in_cents", - "marketplace_listing", + "@timestamp", "_document_id", "action", - "description", - "bullets", - "yearly_price_in_cents", - "request_id", - "actor_id", - "has_free_trial", - "marketplace_listing_plan", - "user_agent", - "@timestamp", - "operation_type", "actor", - "created_at" - ] + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "monthly_price_in_cents", + "marketplace_listing", + "description", + "bullets", + "yearly_price_in_cents", + "has_free_trial", + "marketplace_listing_plan", + "operation_type", + "created_at" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -5449,22 +8287,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -5472,19 +8323,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5492,21 +8355,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5516,16 +8388,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5535,18 +8420,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5556,14 +8454,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -5571,19 +8485,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -5591,42 +8516,62 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "org", - "created_at", - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", - "request_access_security_header" - ] - }, - { - "action": "migration.create", - "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A", - "fields": [ - "repo", - "org_id", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", + "operation_type" + ] + }, + { + "action": "migration.create", + "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "user_agent", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -5634,20 +8579,30 @@ "description": "An OAuth access token was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", "fields": [ - "_document_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "user", - "user_id", - "created_at", + "_document_id", "action", + "actor", "actor_id", - "request_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" @@ -5658,19 +8613,30 @@ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", "fields": [ "@timestamp", - "user_agent", - "action", - "operation_type", "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_id", + "user_agent", + "operation_type", + "created_at", "explanation", - "hashed_token", - "actor_id", - "token_scopes", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" @@ -5680,19 +8646,30 @@ "description": "An OAuth access token was regenerated.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "_document_id", - "created_at", "@timestamp", - "operation_type", + "_document_id", "action", - "user_agent", - "request_id", "actor", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "oauth_application_name" ] }, @@ -5701,18 +8678,30 @@ "description": "An OAuth access token was updated.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -5720,20 +8709,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5742,20 +8743,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5764,20 +8777,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5786,20 +8811,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5808,19 +8845,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5829,20 +8879,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5851,20 +8913,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5874,18 +8948,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user_agent", - "org_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "oauth_application_id", - "action", "created_at", - "actor", - "actor_id", - "oauth_application", - "_document_id", - "request_id" + "oauth_application" ] }, { @@ -5893,19 +8980,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5914,15 +9014,32 @@ "description": "An OAuth application was unsuspended for a user or organization account.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "operation_type", - "org_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "oauth_application_id", "oauth_application", - "org", - "created_at", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5931,24 +9048,31 @@ "description": "An authorization for an OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ - "operation_type", - "user_agent", - "user_id", - "actor", - "org_id", + "@timestamp", "_document_id", - "request_id", "action", - "@timestamp", - "created_at", + "actor", "actor_id", - "user", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_is_bot", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -5958,20 +9082,31 @@ "description": "An authorization for an OAuth application was deleted.", "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", "fields": [ - "user_agent", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "actor", "created_at", "explanation", - "user", - "user_id", - "org_id", - "action", - "actor_id", - "token_scopes", "actor_is_bot", "oauth_application_name" ], @@ -5982,20 +9117,31 @@ "description": "An authorization for an OAuth application was updated.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ - "org_id", - "request_id", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "@timestamp", "operation_type", - "action", - "user", "created_at", - "_document_id", "actor_is_bot", - "request_access_security_header", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -6005,17 +9151,28 @@ "description": "An invitation sent to an organization to join an enterprise was accepted.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6026,20 +9183,30 @@ "description": "A billing manager was added to an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "org", - "user_id", "action", - "created_at", - "org_id", - "user", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" }, @@ -6048,21 +9215,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -6071,24 +9248,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -6096,21 +9283,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -6118,20 +9315,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -6139,22 +9346,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -6162,20 +9377,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -6183,42 +9408,61 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" - ] - }, + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, { "action": "org.advanced_security_policy_selected_member_disabled", "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -6227,19 +9471,30 @@ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -6249,16 +9504,29 @@ "description": "A user initiated a background job to delete an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "@timestamp", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "created_at" ] }, @@ -6267,16 +9535,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_agent", - "action", "@timestamp", - "actor_id", - "org_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -6285,18 +9566,31 @@ "description": "An organization owner blocked a user from accessing the organization's repositories.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", "fields": [ - "actor", - "user_agent", - "org_id", - "created_at", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "blocked_user", + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" }, @@ -6305,19 +9599,30 @@ "description": "An invitation for an organization to join an enterprise was revoked", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "initiated_from" ], "docs_reference_titles": "Adding organizations to your enterprise" @@ -6327,22 +9632,33 @@ "description": "An invitation sent to a user to join an organization was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "email", - "@timestamp", - "actor", - "action", "operation_type", - "user_agent", - "org", "invitation_id", - "_document_id", "created_at", - "invitee_email", - "token_scopes", - "programmatic_access_type" + "invitee_email" ] }, { @@ -6350,19 +9666,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -6370,23 +9697,31 @@ "description": "Autofix for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6394,21 +9729,31 @@ "description": "Autofix for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", - "org", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6416,23 +9761,31 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6440,23 +9793,31 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6464,21 +9825,30 @@ "description": "Code scanning using the default setup was disabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -6487,21 +9857,30 @@ "description": "Code scanning using the default setup was enabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -6510,16 +9889,29 @@ "description": "The interaction limit for collaborators only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "request_id", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" @@ -6529,17 +9921,30 @@ "description": "The interaction limit for prior contributors only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "operation_type", "@timestamp", - "created_at", - "user_agent", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", - "actor", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6548,17 +9953,30 @@ "description": "The interaction limit for existing users only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", "_document_id", - "operation_type", - "actor_id", - "org_id", "action", - "created_at", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6568,16 +9986,29 @@ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ "@timestamp", - "created_at", "_document_id", - "actor_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "action", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6586,17 +10017,30 @@ "description": "The interaction limit for prior contributors only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "operation_type", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6605,17 +10049,30 @@ "description": "The interaction limit for existing users only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "actor_id", - "request_id", + "@timestamp", + "_document_id", "action", - "created_at", - "user_agent", "actor", - "_document_id", - "org_id", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6624,22 +10081,30 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" }, @@ -6648,17 +10113,28 @@ "description": "An invitation for an organization to join an enterprise was confirmed.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6669,18 +10145,30 @@ "description": "An organization was created.", "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", "fields": [ - "request_id", - "org", - "actor_id", - "actor", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "org_id", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" }, @@ -6689,18 +10177,30 @@ "description": "An organization was deleted by a user or staff.", "docs_reference_links": "N/A", "fields": [ - "user_agent", "@timestamp", "_document_id", - "created_at", - "actor", - "org_id", - "org", "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6708,20 +10208,30 @@ "description": "Team creation was limited to owners.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "actor", "@timestamp", "_document_id", - "user", - "user_id", "action", - "created_at", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -6730,19 +10240,30 @@ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -6751,14 +10272,31 @@ "description": "SAML single sign-on was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sso_url", "issuer", - "action", - "@timestamp", - "_document_id", "created_at", - "org", "operation_type" ] }, @@ -6767,17 +10305,30 @@ "description": "A two-factor authentication requirement was disabled for the organization.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "org_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "_document_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6785,19 +10336,30 @@ "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "user", - "action", - "operation_type", "@timestamp", "_document_id", - "created_at", - "user_agent", - "org", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6805,19 +10367,30 @@ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ - "org", - "user_agent", - "request_id", - "actor", + "@timestamp", "_document_id", - "user_id", - "operation_type", - "@timestamp", - "created_at", - "user", "action", + "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6825,19 +10398,30 @@ "description": "Team creation by members was allowed.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "org_id", - "user", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -6846,19 +10430,30 @@ "description": "An organization owner allowed users with read access to create discussions in an organization", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -6867,19 +10462,32 @@ "description": "SAML single sign-on was enabled for the organization.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", - "sso_url", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "@timestamp", - "issuer", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "sso_url", + "created_at", + "issuer" ], "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" }, @@ -6888,17 +10496,30 @@ "description": "Two-factor authentication is now required for the organization.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "actor_id", - "action", - "_document_id", - "org", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" }, @@ -6907,17 +10528,30 @@ "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "org_id", - "manager", "@timestamp", - "request_id", - "actor", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "manager", + "operation_type", "created_at" ] }, @@ -6926,18 +10560,31 @@ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", "docs_reference_links": "N/A", "fields": [ - "org_id", "@timestamp", - "org", - "user_agent", - "request_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "manager", "operation_type", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6945,23 +10592,32 @@ "description": "A new user was invited to join an organization.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", "fields": [ - "org", - "user_id", - "invitation_id", - "org_id", - "user", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", - "created_at", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "invitee_email", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitation_id", + "operation_type", + "created_at", + "invitee_email" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" }, @@ -6970,17 +10626,28 @@ "description": "An organization was invited to join an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -6990,19 +10657,30 @@ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7010,19 +10688,30 @@ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "org", - "org_id", - "user_agent", - "actor_id", - "user_id", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7031,16 +10720,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "org_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type", - "_document_id", - "org" + "created_at", + "operation_type" ] }, { @@ -7048,17 +10750,30 @@ "description": "An organization was restored.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "org_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7066,19 +10781,31 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", "fields": [ - "actor", - "operation_type", "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "actor_is_bot", - "request_access_security_header" + "operation_type", + "created_at", + "actor_is_bot" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -7087,18 +10814,29 @@ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "user_id", - "user_agent", - "org_id", - "user", - "action", - "_document_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" @@ -7108,21 +10846,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7130,21 +10877,30 @@ "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ - "org", - "user", - "org_id", - "created_at", - "request_id", "@timestamp", - "action", - "operation_type", - "user_agent", "_document_id", + "action", "actor", "actor_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7152,21 +10908,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -7174,18 +10940,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", "fields": [ - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "actor", - "action", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -7194,19 +10972,31 @@ "description": "An organization was renamed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "_document_id", "@timestamp", - "org", + "_document_id", "action", "actor", - "old_login", - "org_id", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_login", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -7214,20 +11004,30 @@ "description": "An organization member was restored.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", "fields": [ - "user", - "actor", - "user_id", + "@timestamp", "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "actor_id", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" }, @@ -7236,21 +11036,33 @@ "description": "A self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" @@ -7260,21 +11072,31 @@ "description": "A self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7283,23 +11105,33 @@ "description": "The REST API was used to remove a self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -7308,23 +11140,31 @@ "description": "A self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7333,19 +11173,32 @@ "description": "A runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -7354,25 +11207,36 @@ "description": "The configuration of a self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7381,21 +11245,30 @@ "description": "Automatic partner validation checks have been disabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -7405,21 +11278,30 @@ "description": "Automatic partner validation checks have been enabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -7429,20 +11311,30 @@ "description": "A custom pattern was created for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7451,22 +11343,30 @@ "description": "A custom pattern was removed from secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7475,21 +11375,30 @@ "description": "A custom pattern was published for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7498,21 +11407,30 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7521,22 +11439,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7545,21 +11471,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7568,21 +11503,30 @@ "description": "Secret scanning for non-provider patterns was disabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7592,21 +11536,30 @@ "description": "Secret scanning for non-provider patterns was enabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7616,19 +11569,30 @@ "description": "A role or team was added to the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7638,21 +11602,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7662,21 +11635,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7686,19 +11668,30 @@ "description": "A role or team was removed from the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7708,22 +11701,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7732,22 +11733,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7756,22 +11765,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7780,21 +11797,30 @@ "description": "Push protection for secret scanning was disabled.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7803,21 +11829,30 @@ "description": "Push protection for secret scanning was enabled.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7826,22 +11861,30 @@ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7850,22 +11893,30 @@ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "token_scopes" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7874,26 +11925,35 @@ "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -7902,26 +11962,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7929,28 +11997,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7958,26 +12034,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7985,15 +12069,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -8002,15 +12103,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -8019,7 +12137,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -8034,20 +12173,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -8056,16 +12206,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -8076,18 +12239,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -8096,17 +12272,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", "_document_id", - "org_id", - "operation_type", + "action", "actor", "actor_id", - "@timestamp", - "request_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", - "action" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8114,18 +12303,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -8134,18 +12335,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -8154,18 +12368,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -8174,22 +12400,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", "actor_id", - "org_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issuer", - "business", "operation_type", "created_at", - "request_id", - "business_id", - "_document_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8197,19 +12433,31 @@ "description": "A user account was converted into an organization.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization", "fields": [ - "actor", + "@timestamp", "_document_id", - "request_id", - "operation_type", + "action", + "actor", "actor_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "@timestamp", - "created_at", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "owner", - "request_access_security_header" + "operation_type", + "created_at", + "owner" ], "docs_reference_titles": "Converting a user into an organization" }, @@ -8218,19 +12466,32 @@ "description": "A user was unblocked from an organization.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", "fields": [ - "oauth_application_id", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", - "@timestamp", - "request_id", - "created_at", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "blocked_user", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" }, @@ -8239,23 +12500,34 @@ "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "updated_allowed_types", "old_policy", - "updated_access_policy", - "programmatic_access_type", - "request_access_security_header" + "updated_access_policy" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" }, @@ -8264,20 +12536,32 @@ "description": "The default repository permission level for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", + "created_at", "permission", - "actor_id", - "old_permission", - "_document_id", - "programmatic_access_type" + "old_permission" ] }, { @@ -8286,20 +12570,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -8307,17 +12602,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -8327,20 +12635,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -8349,19 +12668,32 @@ "description": "An organization's SAML provider settings were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "sso_url", - "actor_id", - "operation_type", "@timestamp", - "issuer", - "org", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "operation_type", + "issuer", + "created_at" ] }, { @@ -8369,18 +12701,30 @@ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", "fields": [ - "request_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "_document_id", - "org", - "action", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" }, @@ -8389,20 +12733,33 @@ "description": "A domain was approved for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "org_id", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" }, @@ -8411,16 +12768,31 @@ "description": "A domain was added to an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "created_at", + "@timestamp", "_document_id", - "domain_name", "action", - "request_id", + "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "domain_name", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8429,14 +12801,29 @@ "description": "A domain was removed from an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", "fields": [ - "action", - "domain_name", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "domain_name", "operation_type", "created_at" ], @@ -8447,16 +12834,31 @@ "description": "A domain was verified for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "operation_type", - "domain_name", "@timestamp", - "user_agent", - "request_id", - "actor", - "action", - "created_at", "_document_id", - "actor_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "domain_name", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8465,20 +12867,31 @@ "description": "An entire package was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", - "package", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "package", + "operation_type", + "created_at", "actor_is_bot" ], "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" @@ -8488,23 +12901,34 @@ "description": "A package was published or republished to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "ecosystem", "version_count", "is_republished", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -8513,21 +12937,32 @@ "description": "A specific package version was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "version", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "ecosystem", "actor_is_bot" ], @@ -8538,21 +12973,34 @@ "description": "A specific package version was published or republished to a package.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "ecosystem", "package", "version", - "actor_id", - "user_agent", "is_republished", - "actor", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -8561,20 +13009,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -8583,17 +13045,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8604,20 +13081,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -8626,19 +13117,31 @@ "description": "A new passkey was added.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8646,19 +13149,31 @@ "description": "A new passkey was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8666,18 +13181,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8685,35 +13212,61 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" - ] - }, - { - "action": "payment_method.update", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "payment_method.update", "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8721,18 +13274,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8743,18 +13309,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8765,17 +13344,30 @@ "description": "Triggered when you create a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8785,19 +13377,31 @@ "description": "Triggered when you regenerate a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8805,12 +13409,29 @@ "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", "fields": [ - "user_programmatic_access_name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", "operation_type" ], @@ -8821,20 +13442,32 @@ "description": "Triggered when you delete a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "explanation", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8842,23 +13475,34 @@ "description": "A personal access token expiration limit was set.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "token_expiration", "old_token_expiration", "exempt_administrators", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8866,39 +13510,63 @@ "description": "A personal access token expiration limit was unset.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "programmatic_access_type", - "old_token_expiration", "business", "business_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "actor_is_bot", - "request_access_security_header" - ] - }, - { - "action": "personal_access_token.request_cancelled", - "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_token_expiration", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, + { + "action": "personal_access_token.request_cancelled", + "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8909,18 +13577,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8932,17 +13613,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8954,17 +13648,30 @@ "description": "A fine-grained personal access token was updated.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8975,15 +13682,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8993,17 +13715,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -9013,15 +13746,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9031,17 +13779,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9051,17 +13810,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9071,17 +13841,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -9091,17 +13872,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9111,17 +13903,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -9131,17 +13936,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9149,20 +13967,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -9172,25 +14001,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -9198,20 +14039,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9219,25 +14072,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9245,17 +14110,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -9263,17 +14141,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -9281,18 +14172,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -9301,18 +14204,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -9321,19 +14236,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -9341,17 +14267,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -9363,22 +14302,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -9386,19 +14334,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -9406,17 +14365,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9424,18 +14396,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -9443,20 +14428,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9464,38 +14459,62 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -9504,16 +14523,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -9525,21 +14557,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -9547,22 +14591,32 @@ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", "fields": [ - "repo", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "name", "created_at", - "_document_id", "operation_type", - "actor", - "repo_id", - "org", - "request_id", - "actor_id", - "oauth_application_id", - "@timestamp", - "programmatic_access_type" + "oauth_application_id" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" }, @@ -9571,29 +14625,34 @@ "description": "A protected branch allowance was given to a specific user, team or integration.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "authorized_actors", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -9601,24 +14660,32 @@ "description": "Branch protection was enabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "repo_id", - "user_id", "@timestamp", - "user_agent", - "repo", - "name", - "org_id", - "user", "_document_id", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", "created_at", "authorized_actor_names", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -9629,21 +14696,31 @@ "description": "Branch protection was disabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "repo", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", - "request_id", - "repo_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "name", + "operation_type", "created_at", - "_document_id", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -9654,22 +14731,32 @@ "description": "Enforcement of dismissing stale pull requests was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "dismiss_stale_reviews_on_push", - "org_id", - "action", - "created_at", - "request_id", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismiss_stale_reviews_on_push", + "created_at", "operation_type", - "actor", - "repo", - "org", - "name", - "programmatic_access_type" + "name" ] }, { @@ -9677,24 +14764,34 @@ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", - "oauth_application_id", - "authorized_actors_only", - "authorized_actors", - "created_at", - "user_agent", - "name", - "_document_id", - "org_id", - "request_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "operation_type", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "authorized_actors_only", + "authorized_actors", + "created_at", + "name", + "operation_type" ] }, { @@ -9702,30 +14799,37 @@ "description": "A branch protection requirement was overridden by a repository administrator.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "actor", "reasons", - "@timestamp", "before", "after", - "actor_id", - "repo", "operation_type", - "user_agent", "branch", "overridden_codes", - "org", - "org_id", - "action", - "_document_id", - "request_id", "referrer", - "business", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "rule_suite_id" ] @@ -9735,28 +14839,36 @@ "description": "A branch update attempt was rejected.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "request_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "branch", "before", "overridden_codes", "after", - "action", "reasons", - "actor_id", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "actor_is_bot", "rule_suite_id" @@ -9767,23 +14879,32 @@ "description": "Branch protection was enforced for repository administrators.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "admin_enforced", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "name", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "action", "repo_id", - "org_id", - "_document_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "admin_enforced", + "operation_type", + "name", + "created_at" ] }, { @@ -9791,22 +14912,32 @@ "description": "Branch deletion was enabled or disabled for a protected branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "operation_type", - "request_id", - "repo", "@timestamp", - "org_id", - "org", - "action", - "allow_deletions_enforcement_level", "_document_id", - "created_at", - "actor_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_deletions_enforcement_level", + "created_at" ] }, { @@ -9814,23 +14945,32 @@ "description": "Force pushes were enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "actor_id", - "name", + "@timestamp", "_document_id", + "action", "actor", - "repo", - "operation_type", - "request_id", - "allow_force_pushes_enforcement_level", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_force_pushes_enforcement_level", + "created_at" ] }, { @@ -9838,24 +14978,33 @@ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "ignore_approvals_from_contributors", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -9864,22 +15013,32 @@ "description": "Required linear commit history was enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "operation_type", "actor", - "linear_history_requirement_enforcement_level", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "linear_history_requirement_enforcement_level", "name", - "org_id", - "repo_id", - "org", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ] }, { @@ -9887,24 +15046,33 @@ "description": "Fork syncing was enabled or disabled for a read-only branch", "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "lock_allows_fetch_and_merge", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -9913,27 +15081,34 @@ "description": "The enforcement of a branch lock was updated.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "enforcement_level", "lock_branch_enforcement_level", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -9942,18 +15117,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9964,24 +15152,33 @@ "description": "A branch name pattern was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "old_name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "old_name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -9989,25 +15186,32 @@ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", "docs_reference_links": "N/A", "fields": [ - "name", - "org_id", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "@timestamp", + "business", "business_id", - "request_id", - "pull_request_reviews_enforcement_level", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "business", - "user_agent", - "created_at", "repo_id", - "operation_type", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "pull_request_reviews_enforcement_level", + "created_at", + "operation_type" ] }, { @@ -10015,22 +15219,32 @@ "description": "Enforcement of required code owner review was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "created_at", - "require_code_owner_review", - "operation_type", - "name", - "user_agent", - "action", "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "request_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "require_code_owner_review", + "operation_type", + "name" ] }, { @@ -10038,22 +15252,33 @@ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "require_last_push_approval", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" }, @@ -10062,22 +15287,32 @@ "description": "Enforcement of the required number of approvals before merging was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "required_approving_review_count", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "required_approving_review_count", "created_at", - "actor", "operation_type", - "user_agent", - "name", - "org_id", - "action", - "actor_id", - "_document_id", - "org", - "@timestamp", - "programmatic_access_type" + "name" ] }, { @@ -10085,25 +15320,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "user_agent", "@timestamp", "_document_id", - "name", - "repo", "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "business", - "actor_id", - "operation_type", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "required_status_checks_enforcement_level", - "org", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "required_status_checks_enforcement_level" ] }, { @@ -10111,22 +15353,32 @@ "description": "Enforcement of required commit signing was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "name", "@timestamp", - "created_at", "_document_id", - "request_id", - "repo_id", - "org", - "org_id", "action", "actor", "actor_id", - "signature_requirement_enforcement_level", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "programmatic_access_type" + "operation_type", + "name", + "created_at", + "signature_requirement_enforcement_level" ] }, { @@ -10134,22 +15386,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "created_at", - "repo_id", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "name", - "actor", - "repo", "operation_type", - "action", - "strict_required_status_checks_policy", - "programmatic_access_type" + "strict_required_status_checks_policy" ] }, { @@ -10157,23 +15419,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -10182,24 +15455,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -10208,20 +15492,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10230,21 +15528,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -10254,22 +15565,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10278,25 +15601,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10305,23 +15638,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", - "created_at", - "key", - "fingerprint", - "actor_id", "actor", - "title", - "user_agent", - "user_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "read_only", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "key", + "fingerprint", + "title", + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10330,18 +15674,32 @@ "description": "A pull request was closed without being merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" @@ -10351,21 +15709,32 @@ "description": "A pull request was converted to a draft.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" }, @@ -10374,19 +15743,32 @@ "description": "A pull request was created.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -10397,23 +15779,35 @@ "description": "A review was requested on a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -10423,17 +15817,31 @@ "description": "A pull request was marked as in progress.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -10441,19 +15849,32 @@ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -10461,19 +15882,32 @@ "description": "A pull request was merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" @@ -10483,21 +15917,32 @@ "description": "A pull request was marked as ready for review.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" }, @@ -10506,27 +15951,34 @@ "description": "A pull request was rebased.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", - "pull_request_url", - "pull_request_title", - "user", - "user_id", - "repo", - "repo_id", - "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", + "pull_request_url", + "pull_request_title", + "public_repo", + "created_at", + "operation_type" ] }, { @@ -10534,23 +15986,35 @@ "description": "A review request was removed from a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" }, @@ -10559,18 +16023,32 @@ "description": "A pull request was reopened after previously being closed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -10578,19 +16056,31 @@ "description": "A review comment was added to a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "comment_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -10600,20 +16090,31 @@ "description": "A review comment on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", "@timestamp", "_document_id", - "repo", - "created_at", - "request_id", - "comment_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "comment_id", + "operation_type" ] }, { @@ -10621,18 +16122,31 @@ "description": "A review comment on a pull request was changed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "request_id", - "actor_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "_document_id", - "@timestamp", - "comment_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "comment_id" ] }, { @@ -10640,21 +16154,33 @@ "description": "A review on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ] }, { @@ -10662,20 +16188,33 @@ "description": "A review on a pull request was dismissed.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" }, @@ -10684,19 +16223,33 @@ "description": "A review on a pull request was submitted.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" @@ -10706,22 +16259,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", - "actor_id", - "user_id", - "created_at", - "user_agent", - "actor", + "_document_id", "action", - "repo", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -10730,21 +16293,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -10753,25 +16325,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -10780,23 +16359,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -10805,24 +16392,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -10831,23 +16425,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -10857,22 +16459,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -10881,19 +16492,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -10902,24 +16526,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -10928,24 +16562,32 @@ "description": "Autofix for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "public_repo", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -10953,24 +16595,32 @@ "description": "Autofix for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -10978,24 +16628,32 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11003,24 +16661,32 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11028,23 +16694,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -11055,25 +16730,31 @@ "description": "Code scanning using the default setup was disabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -11082,26 +16763,34 @@ "description": "Code scanning using the default setup was enabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "query_suite", "threat_model", - "languages", - "request_access_security_header" + "languages" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -11110,25 +16799,34 @@ "description": "Code scanning using the default setup was updated for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "query_suite", "threat_model", "languages", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Configuring default setup for code scanning" @@ -11138,20 +16836,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "visibility", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11159,18 +16868,31 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "actor", - "actor_id", - "repo_id", + "@timestamp", "_document_id", "action", - "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" - ], + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, { @@ -11178,15 +16900,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -11197,16 +16932,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11216,17 +16964,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11236,19 +16997,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11257,17 +17029,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11276,26 +17061,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -11304,30 +17095,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -11337,20 +17133,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -11359,25 +17166,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -11386,23 +17201,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -11410,25 +17236,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -11438,17 +17273,30 @@ "description": "A repository was archived on disk.", "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories", "fields": [ - "actor_id", - "repo", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", - "repo_id", - "actor", "action", - "user_agent" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/archiving-a-github-repository/archiving-repositories" }, @@ -11457,23 +17305,32 @@ "description": "A source code archive of a repository was downloaded as a ZIP file.", "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "created_at", "operation_type", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" @@ -11483,20 +17340,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "visibility", - "repo_id", - "created_at", - "actor", - "action", - "@timestamp", "org_id", - "request_id", + "programmatic_access_type", "repo", - "_document_id" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "visibility", + "created_at" ] }, { @@ -11504,20 +17372,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "visibility", - "repo_id", - "request_id", - "action", - "_document_id", "@timestamp", - "actor_id", - "created_at", - "user", - "operation_type", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", "public_repo" ] }, @@ -11526,19 +17405,30 @@ "description": "The repository was unlocked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11546,20 +17436,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "action", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "operation_type", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "visibility", - "actor", - "user_id" + "visibility" ] }, { @@ -11567,23 +17468,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", - "repo", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -11591,21 +17502,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -11613,21 +17534,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -11635,22 +17566,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -11658,21 +17598,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -11680,20 +17630,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11701,22 +17662,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -11724,18 +17694,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -11743,22 +17727,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -11766,21 +17760,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -11788,18 +17792,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -11808,22 +17824,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -11832,24 +17857,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -11858,23 +17891,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -11882,26 +17925,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -11910,21 +17958,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -11933,25 +17990,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -11959,22 +18022,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", - "actor", - "old_name", - "repo", - "user_id", - "created_at", - "user", + "_document_id", "action", - "operation_type", - "visibility", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -11983,20 +18056,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "visibility", - "operation_type", - "repo", + "@timestamp", "_document_id", - "user", - "user_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "@timestamp", - "request_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -12004,19 +18088,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -12024,17 +18119,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -12043,17 +18153,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -12062,7 +18187,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -12077,23 +18223,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -12103,20 +18258,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -12127,21 +18293,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -12150,22 +18327,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -12174,21 +18361,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -12197,22 +18395,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -12223,16 +18431,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -12241,22 +18460,31 @@ "description": "Temporary access was enabled for a repository.", "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing user-owned repositories in your enterprise" }, @@ -12266,22 +18494,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -12290,23 +18529,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -12316,19 +18565,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -12336,21 +18595,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -12359,24 +18628,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -12384,25 +18662,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12411,24 +18696,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12437,25 +18732,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12464,22 +18767,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12488,26 +18800,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -12515,31 +18835,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12548,24 +18875,30 @@ "description": "Branch protections were disabled for the repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -12574,24 +18907,30 @@ "description": "Branch protections were enabled for this repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -12600,43 +18939,63 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", - "user", - "user_id", - "request_access_security_header" - ] - }, + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "content_type" + ] + }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -12644,21 +19003,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -12666,20 +19036,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -12687,21 +19069,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -12709,19 +19102,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -12729,31 +19135,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -12762,19 +19176,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -12782,8 +19207,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -12792,23 +19216,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -12833,26 +19266,32 @@ "description": "Automatic partner validation checks have been disabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "public_repo", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -12861,26 +19300,32 @@ "description": "Automatic partner validation checks have been enabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -12889,23 +19334,30 @@ "description": "A custom pattern was created for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12915,23 +19367,30 @@ "description": "A custom pattern was removed from secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12941,24 +19400,31 @@ "description": "A custom pattern was published for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12968,24 +19434,31 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -12994,24 +19467,31 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13021,23 +19501,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13047,23 +19534,31 @@ "description": "Secret scanning was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "public_repo", - "programmatic_access_type" + "public_repo" ], "docs_reference_titles": "About secret scanning" }, @@ -13072,22 +19567,30 @@ "description": "Secret scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13095,24 +19598,32 @@ "description": "Secret scanning for non-provider patterns was disabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -13121,24 +19632,32 @@ "description": "Secret scanning for non-provider patterns was enabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -13147,19 +19666,31 @@ "description": "A role or team was added to the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -13168,24 +19699,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -13194,24 +19733,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -13220,19 +19767,31 @@ "description": "A role or team was removed from the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -13241,26 +19800,31 @@ "description": "Secret scanning push protection was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -13269,26 +19833,31 @@ "description": "Secret scanning push protection was enabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -13297,28 +19866,36 @@ "description": "A code security configuration was applied to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13326,27 +19903,35 @@ "description": "A code security configuration failed to attach to the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13354,28 +19939,36 @@ "description": "A code security configuration was removed from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13383,28 +19976,36 @@ "description": "A code security configuration was removed due to a change in repository or enterprise settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13412,29 +20013,37 @@ "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -13443,29 +20052,37 @@ "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -13474,19 +20091,32 @@ "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ - "operation_type", - "request_id", - "repo_id", "@timestamp", - "user_agent", - "alert_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "alert_id", + "created_at", + "alert_number" ], "docs_reference_titles": "About Dependabot alerts" }, @@ -13495,23 +20125,32 @@ "description": "A Dependabot alert was manually dismissed.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "operation_type", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "alert_id", - "actor", - "repo", "created_at", - "org", - "_document_id", - "action", - "actor_id", "dismiss_reason", - "user", "dismiss_comment", "alert_number", "actor_is_bot" @@ -13522,21 +20161,33 @@ "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "public_repo", "owner", - "_document_id", - "@timestamp", "operation_type", - "token_scopes", "alert_number" ] }, @@ -13545,26 +20196,34 @@ "description": "A Dependabot alert was manually reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type", - "business", - "business_id", "public_repo", - "alert_number", - "request_access_security_header" + "alert_number" ] }, { @@ -13572,21 +20231,32 @@ "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", "docs_reference_links": "N/A", "fields": [ - "alert_id", - "repo", - "operation_type", - "action", - "repo_id", - "_document_id", - "user_agent", - "request_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "alert_id", + "operation_type", + "created_at", + "alert_number" ] }, { @@ -13594,21 +20264,35 @@ "description": "A Dependabot alert was withdrawn.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", "created_at", "active", - "action", - "repository_id", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type" ] }, @@ -13617,20 +20301,30 @@ "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", "fields": [ - "org", + "@timestamp", "_document_id", - "repo", - "org_id", - "operation_type", - "created_at", - "actor", "action", - "@timestamp", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" }, @@ -13639,24 +20333,31 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -13664,26 +20365,32 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13691,23 +20398,30 @@ "description": "Dependabot alerts was disabled.", "docs_reference_links": "N/A", "fields": [ - "repo", - "request_id", - "repo_id", - "action", - "actor_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "_document_id", "user_id", - "operation_type", - "token_scopes", - "programmatic_access_type" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13715,23 +20429,30 @@ "description": "Dependabot alerts was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_agent", - "created_at", "@timestamp", - "repo_id", + "_document_id", "action", - "user", - "repo", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor_id", - "_document_id", - "user_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot" ] }, @@ -13740,18 +20461,31 @@ "description": "Email notification restrictions for an organization or enterprise were disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -13760,19 +20494,31 @@ "description": "Email notification restrictions for an organization or enterprise were enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -13781,14 +20527,28 @@ "description": "GitHub detected a secret and created a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -13802,22 +20562,32 @@ "description": "A secret scanning alert was reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type_display_name" ] }, @@ -13826,28 +20596,37 @@ "description": "A secret scanning alert was resolved.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "resolution", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", + "resolution", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type", "secret_type_display_name", "publicly_leaked", - "multi_repo", - "request_access_security_header" + "multi_repo" ] }, { @@ -13855,25 +20634,32 @@ "description": "A secret scanning alert was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -13881,14 +20667,28 @@ "description": "A secret scanning alert was validated.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "previous_validity", @@ -13905,19 +20705,30 @@ "description": "Secret scanning was disabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -13926,19 +20737,30 @@ "description": "Secret scanning was enabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -13947,20 +20769,30 @@ "description": "Secret scanning was disabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -13969,19 +20801,30 @@ "description": "Secret scanning was enabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -13990,14 +20833,28 @@ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "push_protection_bypass_reason", @@ -14015,25 +20872,33 @@ "description": "A request to bypass secret scanning push protection was approved by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -14042,25 +20907,33 @@ "description": "A request to bypass secret scanning push protection was denied by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", - "request_access_security_header", "request_reviewer_comment" ], "docs_reference_titles": "About push protection" @@ -14070,25 +20943,33 @@ "description": "A user requested to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" }, @@ -14097,10 +20978,28 @@ "description": "A security configuration was created", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -14115,15 +21014,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -14141,22 +21033,33 @@ "description": "A default security configuration setting for new repositories was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14165,22 +21068,33 @@ "description": "A default security configuration setting for new repositories was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14189,15 +21103,33 @@ "description": "A security configuration was deleted", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "security_configuration_id", - "security_configuration_name", - "security_configuration_description", - "security_configuration_created_at", - "security_configuration_updated_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "security_configuration_id", + "security_configuration_name", + "security_configuration_description", + "security_configuration_created_at", + "security_configuration_updated_at", "security_configuration_enable_ghas", "security_configuration_private_vulnerability_reporting", "security_configuration_dependency_graph", @@ -14207,15 +21139,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -14232,15 +21157,30 @@ "description": "A security configuration policy was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enforcement", "security_configuration_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14250,10 +21190,28 @@ "description": "A security configuration was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -14268,15 +21226,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -14294,18 +21245,30 @@ "description": "A security key was registered for an account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "created_at", - "user_id", - "action", - "operation_type", - "request_id", "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -14313,18 +21276,30 @@ "description": "A security key was removed from an account.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "operation_type", - "_document_id", - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14332,16 +21307,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14351,18 +21339,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -14371,16 +21372,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14391,15 +21405,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -14409,15 +21436,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -14426,17 +21468,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -14445,17 +21500,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -14464,16 +21533,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -14483,14 +21565,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -14500,17 +21597,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -14519,17 +21629,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -14538,18 +21661,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14558,15 +21694,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -14576,16 +21726,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14593,15 +21756,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -14612,16 +21788,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -14631,17 +21820,30 @@ "description": "Triggered when you send an email update to your sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", "fields": [ - "request_id", - "actor", - "action", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" }, @@ -14650,17 +21852,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -14671,17 +21886,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -14692,18 +21920,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14713,16 +21952,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14732,17 +21984,30 @@ "description": "You join the waitlist to join GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "actor_id", - "action", "operation_type", - "created_at", - "user", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -14751,16 +22016,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14772,17 +22050,30 @@ "fields": [ "@timestamp", "_document_id", - "fingerprint", - "operation_type", - "openssh_public_key", - "org_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "request_id" + "fingerprint", + "operation_type", + "openssh_public_key", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -14791,19 +22082,32 @@ "description": "An SSH certificate authority for an organization or enterprise was deleted.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "created_at", + "@timestamp", "_document_id", - "fingerprint", - "operation_type", + "action", "actor", - "org_id", - "openssh_public_key", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", - "request_id" + "created_at", + "fingerprint", + "operation_type", + "openssh_public_key" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -14812,21 +22116,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "user", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "request_id", - "org", - "org_id", - "created_at", - "actor", "action", - "user_id", + "actor", + "actor_id", "business", "business_id", - "@timestamp", - "actor_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -14835,19 +22148,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "actor_id", - "user_id", - "org", - "operation_type", - "request_id", "@timestamp", "_document_id", - "actor", - "user", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -14856,20 +22180,34 @@ "description": "The verification code expiry time for an organization or enterprise domain was set.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "token_expires_at", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14877,18 +22215,33 @@ "description": "An organization or enterprise domain was unverified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ] }, { @@ -14896,16 +22249,31 @@ "description": "An organization or enterprise domain was verified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "domain_name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14913,23 +22281,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14937,23 +22315,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14961,23 +22349,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14985,23 +22383,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15009,15 +22417,30 @@ "description": "Triggered when you accept a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -15026,15 +22449,30 @@ "description": "Triggered when you cancel a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -15043,15 +22481,30 @@ "description": "Triggered when you create a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -15060,15 +22513,30 @@ "description": "Triggered when you decline a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -15077,15 +22545,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15093,15 +22576,30 @@ "description": "Triggered when you revoke a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -15110,21 +22608,31 @@ "description": "A member of an organization was added to a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", "fields": [ - "user_agent", - "request_id", - "org_id", - "user_id", - "team", - "user", "@timestamp", - "actor_id", - "created_at", - "operation_type", "_document_id", - "org", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" @@ -15134,22 +22642,31 @@ "description": "A team was given access and permissions to a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "team", - "action", - "operation_type", - "request_id", - "created_at", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "actor_id", - "_document_id", "repo_id", - "user_agent", - "org_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -15158,20 +22675,31 @@ "description": "A child team was created or a child team's parent was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", "fields": [ - "org", "@timestamp", - "created_at", "_document_id", - "team", "action", - "operation_type", "actor", - "request_id", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", + "operation_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" }, @@ -15180,42 +22708,66 @@ "description": "A team's privacy level was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", "fields": [ - "user_agent", - "request_id", - "org", + "@timestamp", + "_document_id", "action", - "team", - "created_at", - "operation_type", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "actor", - "_document_id", - "team_type" - ], - "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" - }, + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type", + "team_type" + ], + "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" + }, { "action": "team.create", "description": "A new team is created.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "oauth_application_id", + "operation_type", "team", - "org", - "actor", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "team_type" ] }, @@ -15224,21 +22776,31 @@ "description": "A user was demoted from a team maintainer to a team member.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" }, @@ -15247,19 +22809,31 @@ "description": "A team was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "team", "org_id", - "actor_id", - "actor", - "action", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", "operation_type", - "_document_id", - "programmatic_access_type", "team_type" ] }, @@ -15268,19 +22842,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "business_id", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", "actor_id", - "user", "business", - "action", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15288,19 +22873,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "operation_type", - "request_id", "actor", - "org", - "created_at", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", - "_document_id" + "operation_type", + "created_at" ] }, { @@ -15308,18 +22904,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", "@timestamp", - "action", "_document_id", - "user_agent", - "user_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business", + "user_id", + "user_agent", "operation_type", - "actor", "created_at" ] }, @@ -15328,22 +22935,31 @@ "description": "A user was promoted from a team member to a team maintainer.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" }, @@ -15352,22 +22968,31 @@ "description": "An organization member was removed from a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", "fields": [ - "request_id", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "team", - "user_id", - "actor", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", + "user_id", "user_agent", - "_document_id", - "token_scopes", - "programmatic_access_type", + "operation_type", + "created_at", + "team", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" @@ -15377,43 +23002,64 @@ "description": "A repository was removed from a team's control.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "org_id", - "repo", - "repo_id", - "action", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", "actor_id", - "user_agent", - "created_at", - "team", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "programmatic_access_type" - ] - }, - { - "action": "team.rename", - "description": "A team's name was changed.", - "docs_reference_links": "N/A", - "fields": [ - "name", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "created_at", "team", - "operation_type", - "actor_id", - "org", + "operation_type" + ] + }, + { + "action": "team.rename", + "description": "A team's name was changed.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", "action", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "_document_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "team", + "operation_type", "team_type" ] }, @@ -15422,17 +23068,30 @@ "description": "Team synchronization with a tenant was disabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "request_id", - "org_id", "actor_id", - "operation_type", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -15441,19 +23100,30 @@ "description": "Team synchronization with a tenant was enabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ - "org_id", - "business_id", - "actor", - "created_at", - "user_agent", "@timestamp", - "operation_type", - "business", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -15462,28 +23132,37 @@ "description": "A team's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "team", - "org_id", "@timestamp", - "org", "_document_id", - "old_permission", - "request_id", - "repo", "action", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "old_permission", "operation_type", "created_at", - "user_agent", "permission", "new_repo_permission", "new_repo_base_role", "old_repo_permission", - "old_repo_base_role", - "token_scopes", - "programmatic_access_type" + "old_repo_base_role" ] }, { @@ -15491,17 +23170,30 @@ "description": "A new trusted device was added.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15509,17 +23201,30 @@ "description": "A trusted device was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15527,14 +23232,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "action", - "request_id", - "user_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -15543,15 +23263,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "created_at", - "user_id", - "operation_type", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action" + "created_at", + "operation_type" ] }, { @@ -15559,13 +23294,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "created_at", - "user_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -15573,17 +23325,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "operation_type", - "action", - "_document_id" + "created_at", + "operation_type" ] }, { @@ -15591,17 +23356,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user", - "created_at", - "request_id", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -15609,16 +23387,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15626,15 +23418,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_id", - "action", "@timestamp", - "created_at", - "user_agent", - "user", "_document_id", - "request_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15642,18 +23449,30 @@ "description": "A secondary authentication factor was added to a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -15662,18 +23481,30 @@ "description": "Two-factor authentication was disabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", "fields": [ - "actor", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor_id", + "user_agent", "created_at", - "operation_type", - "request_id", - "@timestamp", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Disabling two-factor authentication for your personal account" }, @@ -15682,18 +23513,30 @@ "description": "Two-factor authentication was enabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ - "actor", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Configuring two-factor authentication" }, @@ -15702,15 +23545,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user", - "user_id", - "action", "@timestamp", - "request_id", "_document_id", - "user_agent" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15718,16 +23576,29 @@ "description": "Two factor recovery codes were regenerated for a user account.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", + "operation_type", "created_at" ] }, @@ -15736,18 +23607,30 @@ "description": "A secondary authentication factor was removed from a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -15756,15 +23639,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "operation_type", - "user_id", - "user", - "user_agent", - "created_at", + "@timestamp", "_document_id", "action", - "@timestamp" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15773,16 +23671,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "operation_type", "user_agent", - "action", - "request_id", - "actor", - "actor_id" + "created_at", + "operation_type" ] }, { @@ -15790,19 +23701,31 @@ "description": "An email address was added to a user account.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", "operation_type", - "_document_id", - "actor_id", - "actor", "email", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding an email address to your GitHub account" }, @@ -15811,18 +23734,30 @@ "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "created_at", - "user", "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -15830,15 +23765,28 @@ "description": "Audit log entries were exported.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "action", - "request_id", - "actor", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", "created_at" ] @@ -15848,20 +23796,31 @@ "description": "A user was blocked by another user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_id", - "_document_id", "actor_id", - "@timestamp", - "user_agent", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -15869,18 +23828,30 @@ "description": "A user changed their password.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "actor_id", - "operation_type", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "created_at", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15888,18 +23859,30 @@ "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -15908,17 +23891,30 @@ "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -15927,16 +23923,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "user_agent", - "created_at", - "user", "action", - "operation_type", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -15944,16 +23954,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "_document_id", "@timestamp", - "created_at", - "user_agent", - "operation_type", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -15961,16 +23985,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "created_at", - "_document_id", - "user_agent", - "user_id", "@timestamp", - "user", + "_document_id", "action", - "request_access_security_header" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15978,19 +24016,31 @@ "description": "A new user account was created.", "docs_reference_links": "N/A", "fields": [ - "email", - "user_id", - "operation_type", "@timestamp", - "request_id", - "user", - "created_at", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "action", - "programmatic_access_type" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "email", + "operation_type", + "created_at" ] }, { @@ -15998,21 +24048,33 @@ "description": "A user secret for Codespaces was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -16020,20 +24082,31 @@ "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "user_agent", + "@timestamp", "_document_id", - "operation_type", - "oauth_application_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "@timestamp", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -16041,18 +24114,30 @@ "description": "A user account was destroyed by an asynchronous job.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "request_id", - "user_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16061,19 +24146,30 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "oauth_application_id", + "_document_id", "action", - "user", - "created_at", - "user_agent", - "request_id", "actor", "actor_id", - "operation_type", - "_document_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", + "operation_type" ] }, { @@ -16081,18 +24177,30 @@ "description": "A user deleted his or her account, triggering user.async_delete.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", - "created_at", - "user_agent", "user_id", - "operation_type", - "actor_id", - "action", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16100,18 +24208,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "user_agent", "user_id", - "actor_id", - "action", - "operation_type", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16119,18 +24239,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user_id", - "actor", - "operation_type", - "created_at", - "_document_id", "@timestamp", - "user", - "actor_id", + "_document_id", "action", - "request_access_security_header" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16139,17 +24271,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user", "_document_id", "action", - "operation_type", - "user_agent", - "created_at", - "request_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16157,17 +24301,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16175,17 +24332,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16193,17 +24363,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16211,21 +24394,31 @@ "description": "An enterprise managed user claimed an email address.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16233,21 +24426,31 @@ "description": "N/A", "docs_reference_links": "An enterprise managed user unclaimed an email address.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." }, @@ -16256,17 +24459,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16274,17 +24490,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16292,17 +24521,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16310,35 +24552,60 @@ "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "action", - "operation_type", - "request_id", - "created_at", - "_document_id", "@timestamp", - "user", - "org_id", - "actor", - "actor_id", - "user_agent" - ] - }, - { - "action": "user.flag_as_large_scale_contributor", - "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.", - "docs_reference_links": "N/A", - "fields": [ + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", + "created_at" + ] + }, + { + "action": "user.flag_as_large_scale_contributor", + "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", "user_agent", + "operation_type", "created_at" ] }, @@ -16347,17 +24614,31 @@ "description": "A user requested a password reset.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", "fields": [ - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "email", - "created_at", - "user_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" }, @@ -16366,17 +24647,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "created_at", - "user_agent", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor", - "operation_type", - "request_id" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16384,18 +24678,30 @@ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -16404,19 +24710,31 @@ "description": "A user signed in.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "actor_id", "@timestamp", - "user", - "action", - "operation_type", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "actor", - "passkey_nickname", - "request_access_security_header" + "passkey_nickname" ] }, { @@ -16424,18 +24742,30 @@ "description": "A user signed out.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -16443,19 +24773,30 @@ "description": "A comment made by a user was minimized.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", - "actor_id", "@timestamp", - "created_at", - "operation_type", "_document_id", - "user", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16463,18 +24804,30 @@ "description": "A user signed in from a new device.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16482,14 +24835,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", "_document_id", "action", - "@timestamp", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16497,21 +24866,31 @@ "description": "An ordinary user account was promoted to a site administrator.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", + "user_id", "user_agent", + "created_at", "oauth_application_id", - "request_id", - "operation_type", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -16519,16 +24898,29 @@ "description": "A user's account was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user", - "action", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "actor", "operation_type" ] }, @@ -16537,20 +24929,31 @@ "description": "An email address was removed from a user account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "actor", - "actor_id", "created_at", - "email", - "token_scopes", - "programmatic_access_type" + "email" ] }, { @@ -16558,20 +24961,32 @@ "description": "A user secret for Codespaces was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "key", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "key", + "integration", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -16579,17 +24994,30 @@ "description": "A user account was no longer flagged as a large scale contributor.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16597,20 +25025,31 @@ "description": "A username was changed.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "request_id", - "actor_id", - "old_login", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "operation_type", "user_agent", - "token_scopes", - "programmatic_access_type" + "old_login", + "created_at", + "operation_type" ] }, { @@ -16618,17 +25057,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "user_agent", - "request_id", - "action", "@timestamp", - "created_at", - "org_id", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -16637,18 +25088,30 @@ "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "action", "created_at", - "actor", - "operation_type", - "actor_id", - "user_id", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam" }, @@ -16657,18 +25120,30 @@ "description": "A user reset their account password.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "@timestamp", - "_document_id", - "actor", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -16676,16 +25151,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_id", - "action", "@timestamp", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -16696,36 +25184,60 @@ "fields": [ "@timestamp", "_document_id", - "request_id", - "user_id", "action", "actor", - "user", - "operation_type", - "user_agent", "actor_id", - "created_at", - "request_access_security_header" - ], - "docs_reference_titles": "Manage visibility settings for private contributions" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Manage visibility settings for private contributions" }, { "action": "user.sign_in_from_unrecognized_device", "description": "A user signed in from an unrecognized device.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "created_at", - "actor", - "actor_id", - "@timestamp", - "request_access_security_header" + "created_at" ] }, { @@ -16733,18 +25245,30 @@ "description": "A user signed in from an unrecognized device and location.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "created_at", - "_document_id", - "request_id", - "action", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -16752,18 +25276,30 @@ "description": "A user signed in from an unrecognized location.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "action", - "operation_type", - "user_agent", - "user", + "@timestamp", "_document_id", + "action", "actor", - "created_at", "actor_id", - "@timestamp", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16771,22 +25307,33 @@ "description": "Triggered when you clear the status on your profile.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "message", - "user", - "actor_id", "created_at", - "request_id", "limited_availability", - "action", "emoji", - "operation_type", - "user_agent", - "@timestamp", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -16794,23 +25341,33 @@ "description": "Triggered when you set or change the status on your profile.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", "fields": [ - "limited_availability", - "user", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "message", - "user_id", - "created_at", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "limited_availability", + "message", + "created_at", "emoji", - "org", - "actor", - "operation_type", - "token_scopes", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Personalize your profile" }, @@ -16819,21 +25376,31 @@ "description": "A user account was suspended.", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", - "operation_type", - "actor_id", - "user", - "user_agent", - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", - "user_id", + "_document_id", "action", - "token_scopes", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -16841,18 +25408,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", - "actor_id", "@timestamp", - "operation_type", "_document_id", - "user_agent", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16860,18 +25439,30 @@ "description": "A 2FA challenge issued for a user account failed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "_document_id", - "user_agent", - "user", - "actor_id", - "actor", - "user_id", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16881,16 +25472,28 @@ "fields": [ "@timestamp", "_document_id", - "user_id", - "operation_type", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "actor", + "user_id", "user_agent", - "request_id", - "action", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -16898,18 +25501,30 @@ "description": "A user used their 2FA recovery codes.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "user_agent", - "request_id", - "user", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "created_at", - "@timestamp", - "_document_id", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16917,18 +25532,30 @@ "description": "A user downloaded 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -16936,17 +25563,30 @@ "description": "A user printed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", - "user_agent", - "request_id", - "user_id", - "created_at", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16954,18 +25594,30 @@ "description": "A user viewed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_agent", - "actor", - "user_id", - "action", - "created_at", - "user", - "operation_type", "@timestamp", - "request_id", "_document_id", - "request_access_security_header" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16973,17 +25625,30 @@ "description": "A user was prompted for a two-factor authentication code.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", "fields": [ - "user", - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "actor" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" }, @@ -16992,19 +25657,31 @@ "description": "A user was unblocked by another user.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "actor", - "@timestamp", - "user_agent", - "user_id", - "user", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -17013,15 +25690,28 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user_agent", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "request_id", - "actor", - "action", "created_at" ] }, @@ -17030,21 +25720,31 @@ "description": "A user account was unsuspended.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", - "user", "action", - "user_agent", "actor", - "oauth_application_id", - "operation_type", "actor_id", - "created_at", - "@timestamp", - "user_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -17052,21 +25752,33 @@ "description": "A user secret for Codespaces was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17074,18 +25786,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17093,16 +25817,30 @@ "description": "A Dependabot rule was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17112,16 +25850,30 @@ "description": "A Dependabot rule was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17131,18 +25883,31 @@ "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17152,21 +25917,33 @@ "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17174,21 +25951,32 @@ "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -17196,21 +25984,32 @@ "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -17218,16 +26017,30 @@ "description": "A Dependabot rule's conditions, actions, or metadata changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17237,27 +26050,33 @@ "description": "A workflow job was approved.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", - "repo", - "repo_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -17266,23 +26085,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17290,10 +26119,28 @@ "description": "A workflow run was cancelled.", "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17304,20 +26151,9 @@ "run_number", "cancelled_at", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Canceling a workflow run" }, @@ -17326,23 +26162,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17352,10 +26196,28 @@ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17367,19 +26229,9 @@ "conclusion", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -17390,10 +26242,28 @@ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17402,21 +26272,10 @@ "head_branch", "head_sha", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "public_repo", - "programmatic_access_type", "actor_is_bot", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "Understanding GitHub Actions" @@ -17426,23 +26285,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -17451,22 +26322,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -17474,21 +26356,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -17496,25 +26389,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -17522,23 +26423,36 @@ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", "fields": [ - "repo_id", - "repo", - "org_id", - "org", - "business_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "job_name", "runner_labels", "is_hosted_runner", "environment_name", "secrets_passed", - "action", - "_document_id", "operation_type", "created_at", - "@timestamp", "runner_owner_type", "job_workflow_ref", "calling_workflow_refs", @@ -17552,24 +26466,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -17578,10 +26501,28 @@ "description": "A workflow run was re-run.", "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17591,21 +26532,11 @@ "head_sha", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", "rerun_type", "check_run_id", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "Re-running workflows and jobs" @@ -17615,25 +26546,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.16/organization.json b/src/audit-logs/data/ghes-3.16/organization.json index efae4d3be3c2..7c945881903c 100644 --- a/src/audit-logs/data/ghes-3.16/organization.json +++ b/src/audit-logs/data/ghes-3.16/organization.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,29 +67,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -72,21 +103,32 @@ "description": "Credit was accepted for a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Editing a repository security advisory" }, @@ -95,21 +137,32 @@ "description": "Someone was added to the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -117,21 +170,32 @@ "description": "Credit was declined for a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -140,21 +204,32 @@ "description": "Someone was removed from the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -163,18 +238,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -182,17 +269,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -203,39 +301,62 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" - }, + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -244,19 +365,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -265,18 +398,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -284,18 +430,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -303,20 +461,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -325,20 +494,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -349,17 +529,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -367,15 +559,31 @@ "description": "Existing code scanning alerts appeared in a branch.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -385,15 +593,31 @@ "description": "Code scanning alerts were fixed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -403,15 +627,29 @@ "description": "Code scanning alerts were manually dismissed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers", "dismissal_approver_id" ], @@ -422,13 +660,31 @@ "description": "Code scanning alerts were seen for the first time.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -438,15 +694,31 @@ "description": "Code scanning alerts that were previously fixed reappeared.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -456,15 +728,29 @@ "description": "Code scanning alerts that were previously dismissed were reopened.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -474,14 +760,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -491,28 +792,34 @@ "description": "An attempt to create a codespace from a prebuild was made.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "owner", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "user_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_id", + "user_agent", + "name", + "owner", + "pull_request_id", "created_at", "operation_type", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -520,17 +827,30 @@ "description": "Enterprise setting for Codespaces ownership was updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enablement", "organization_names", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -541,25 +861,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -570,22 +899,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -597,22 +937,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "repository_id", - "repository", - "pull_request_id", - "owner", - "name", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", - "token_scopes", - "programmatic_access_type" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", + "owner", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -621,15 +972,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -640,15 +1006,28 @@ "description": "Policies were applied to codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -658,20 +1037,30 @@ "description": "Policies were removed from codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -679,19 +1068,30 @@ "description": "Policies were updated for codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -699,17 +1099,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -719,27 +1132,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "org", "owner", "pull_request_id", "machine_type", - "user_id", - "user", "devcontainer_path", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -747,19 +1169,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -767,18 +1202,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -787,42 +1234,61 @@ "description": "A commit comment was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "repo", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "created_at", - "@timestamp", - "operation_type", + "programmatic_access_type", + "repo", "repo_id", - "actor_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "programmatic_access_type" - ] + "created_at", + "operation_type" + ] }, { "action": "commit_comment.update", "description": "A commit comment was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "repo_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_id", - "action", - "@timestamp", - "repo", "org_id", - "actor_id", - "created_at", - "user_agent", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -830,21 +1296,33 @@ "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "reason", "plan", - "org_id", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -852,13 +1330,28 @@ "description": "Copilot feature settings were changed at the organization level.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -868,23 +1361,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -892,16 +1392,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -910,24 +1424,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -935,15 +1455,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -953,20 +1486,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -974,19 +1517,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -994,43 +1549,64 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "business", - "business_id" - ] - }, + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, { "action": "copilot.cfb_seat_management_changed", "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_value", "new_value", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1038,21 +1614,32 @@ "description": "The excluded paths for GitHub Copilot were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "excluded_paths", "owner_type", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1060,21 +1647,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1082,21 +1679,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1104,21 +1711,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1126,17 +1743,30 @@ "description": "The plan for GitHub Copilot was updated.", "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_plan", "plan", - "business_id", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1148,20 +1778,31 @@ "description": "The plan for GitHub Copilot was scheduled to be downgraded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "current_plan", "scheduled_plan" @@ -1172,21 +1813,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1196,43 +1846,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type" - ] + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1242,18 +1910,31 @@ "description": "A new custom property definition was created.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -1266,18 +1947,31 @@ "description": "A custom property definition was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -1291,14 +1985,29 @@ "description": "A custom property definition was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "value_type", @@ -1311,8 +2020,7 @@ "old_default_value", "old_value_type", "old_values_editable_by", - "values_editable_by", - "request_access_security_header" + "values_editable_by" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1321,27 +2029,35 @@ "description": "A repository's custom property value was manually set for the first time.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1350,19 +2066,31 @@ "description": "A repository's custom property value was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1371,16 +2099,29 @@ "description": "A repository's custom property value was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "definition_id" @@ -1392,19 +2133,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1413,19 +2165,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1434,19 +2197,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1455,19 +2229,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1476,17 +2261,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1494,19 +2292,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1515,19 +2324,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1535,19 +2355,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1556,19 +2387,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1576,19 +2418,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1597,19 +2450,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1617,20 +2481,31 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" - ], + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, { @@ -1638,20 +2513,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1659,21 +2544,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", - "repo_id", - "request_id", + "@timestamp", + "_document_id", "action", "actor", - "org_id", - "_document_id", "actor_id", - "operation_type", - "@timestamp", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -1681,20 +2575,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo_id", "@timestamp", - "actor", - "user_agent", - "request_id", - "org", "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "repo", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -1702,22 +2606,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "user_agent", - "actor_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "title", - "_document_id", - "created_at", - "repo", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -1725,21 +2638,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "team", - "created_at", - "user_id", "@timestamp", - "number", - "org", - "title", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", "user_agent", - "operation_type", - "_document_id" + "team", + "created_at", + "number", + "title", + "operation_type" ] }, { @@ -1747,18 +2672,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user_id", - "actor", "number", - "user", - "created_at", - "request_id", - "_document_id" + "created_at" ] }, { @@ -1766,18 +2704,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "action", - "_document_id", - "request_id", - "org", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org_id", "user_agent", - "actor", + "operation_type", "number", "team", "created_at" @@ -1788,21 +2737,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "_document_id", - "title", - "user", - "user_agent", - "org", - "operation_type", - "actor_id", "@timestamp", - "actor", - "team", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", + "title", + "operation_type", + "team", "number" ] }, @@ -1811,17 +2771,31 @@ "description": "A global announcement banner was created for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "owner", - "owner_type", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", + "owner_type", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -1832,16 +2806,30 @@ "description": "A global announcement banner was removed from the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -1852,18 +2840,32 @@ "description": "A global announcement banner was updated for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", "old_message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -1874,17 +2876,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was created.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", - "operation_type", "@timestamp", "_document_id", - "org_id", "action", - "request_id", - "org", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -1893,17 +2908,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was deleted.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", + "@timestamp", "_document_id", "action", - "@timestamp", - "actor_id", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -1912,22 +2940,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1936,22 +2973,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1959,28 +3006,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1989,27 +3042,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -2018,25 +3079,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2045,26 +3114,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2073,21 +3149,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -2096,22 +3184,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2120,25 +3218,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2147,22 +3254,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -2171,21 +3290,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -2196,19 +3325,30 @@ "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2217,20 +3357,30 @@ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2239,19 +3389,30 @@ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "user", - "user_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2260,23 +3421,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2284,18 +3454,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -2306,20 +3486,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2329,25 +3519,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -2355,25 +3555,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -2381,26 +3590,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -2409,25 +3627,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -2435,26 +3662,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -2462,21 +3698,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -2485,19 +3732,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -2505,21 +3765,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -2528,19 +3799,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -2551,20 +3836,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2574,24 +3871,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2602,23 +3910,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2629,21 +3949,33 @@ "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", "operation_type", - "@timestamp", "integration", - "action", - "user_agent", "reason", - "_document_id", - "org", - "org_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -2654,20 +3986,32 @@ "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ "@timestamp", - "actor_id", - "org", "_document_id", - "requester", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "requester", "created_at", "url", - "org_id", - "request_id", "operation_type", - "actor", "integration", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -2677,20 +4021,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", - "request_id", - "name", - "repository_selection", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "repository_selection", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2700,19 +4057,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -2721,20 +4092,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -2744,20 +4128,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -2766,20 +4163,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -2788,20 +4198,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -2809,19 +4231,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2830,19 +4265,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2851,17 +4299,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2874,21 +4335,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", - "user_id", - "name", - "transfer_to_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "name", + "transfer_to_id", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -2902,17 +4376,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2924,19 +4411,30 @@ "description": "An IP allow list was disabled.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "actor", - "request_id", - "org", - "user_agent", + "@timestamp", "_document_id", - "user_id", + "action", + "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "@timestamp", - "user" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2944,19 +4442,30 @@ "description": "An IP allow list was disabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2964,20 +4473,29 @@ "description": "An IP allow list was enabled.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "user_id", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "business_id", - "_document_id", - "action", - "@timestamp", + "user_id", "user_agent", - "actor_id", "operation_type", - "org", "created_at" ] }, @@ -2986,19 +4504,30 @@ "description": "An IP allow list was enabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3006,24 +4535,32 @@ "description": "An IP address was added to an IP allow list.", "docs_reference_links": "N/A", "fields": [ - "active", - "org", - "ip_allow_list_entry", "@timestamp", "_document_id", - "operation_type", - "created_at", - "user_agent", "action", - "request_id", + "actor", "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "business", - "actor", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", + "ip_allow_list_entry", + "operation_type", + "created_at" ] }, { @@ -3031,24 +4568,32 @@ "description": "An IP address was deleted from an IP allow list.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "ip_allow_list_entry", - "org", - "operation_type", - "created_at", - "active", "action", - "@timestamp", + "actor", + "actor_id", "business", "business_id", - "user_agent", + "hashed_token", + "org", "org_id", - "actor", - "actor_id", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ip_allow_list_entry", + "operation_type", + "created_at", + "active" ] }, { @@ -3056,19 +4601,32 @@ "description": "An IP address or its description was changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "actor_id", "ip_allow_list_entry", - "active", - "org_id", - "@timestamp" + "active" ] }, { @@ -3076,22 +4634,31 @@ "description": "A comment on an issue was deleted from the repository.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "org", - "repo", - "actor_id", "@timestamp", - "created_at", "_document_id", "action", - "operation_type", - "user_agent", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "oauth_application_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -3099,24 +4666,30 @@ "description": "A comment on an issue was pinned to a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3127,19 +4700,29 @@ "description": "A comment on an issue was unpinned from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3150,22 +4733,31 @@ "description": "A comment on an issue (other than the initial one) changed.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", - "action", - "repo_id", - "org_id", - "created_at", - "operation_type", "@timestamp", - "user_agent", - "request_id", "_document_id", - "actor_id", + "action", "actor", - "oauth_application_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -3173,21 +4765,31 @@ "description": "An issue was deleted from the repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", "fields": [ - "user", - "actor_id", - "created_at", - "title", "@timestamp", "_document_id", - "request_id", - "actor", - "user_id", "action", - "operation_type", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "title", + "operation_type" ], "docs_reference_titles": "Deleting an issue" }, @@ -3196,23 +4798,33 @@ "description": "An issue was pinned to a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ + "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", "action", "actor", - "operation_type", - "owner_type", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "number", - "repo", - "event", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type", + "owner_type", + "number", + "event" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -3221,22 +4833,32 @@ "description": "An issue was transferred to another repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "owner_type", - "actor_id", "number", - "repo", "operation_type", - "_document_id", - "repo_id", - "action", - "request_id", - "created_at", - "actor", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Transferring an issue to another repository" }, @@ -3245,24 +4867,33 @@ "description": "An issue was unpinned from a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ - "event", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", - "action", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "operation_type", - "_document_id", - "number", - "owner_type", - "@timestamp", + "token_id", + "token_scopes", "user", "user_id", - "token_scopes", - "request_access_security_header" + "user_agent", + "event", + "created_at", + "operation_type", + "number", + "owner_type" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -3271,61 +4902,94 @@ "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user_agent", - "action", "@timestamp", - "operation_type", - "request_id", - "actor_id", - "user_id", - "created_at", "_document_id", + "action", "actor", - "user", - "org", - "org_id" - ], - "docs_reference_titles": "Enforcing repository management policies in your enterprise" - }, - { - "action": "issues.deletes_enabled", - "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", - "fields": [ "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "request_id", - "actor", - "@timestamp", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type" + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, { - "action": "issues.deletes_policy_cleared", - "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", + "action": "issues.deletes_enabled", + "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", "business_id", - "action", - "operation_type", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "created_at", + "operation_type" + ], + "docs_reference_titles": "Enforcing repository management policies in your enterprise" + }, + { + "action": "issues.deletes_policy_cleared", + "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ "@timestamp", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor_id" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3334,18 +4998,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3353,21 +5029,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -3375,21 +5064,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -3397,22 +5099,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -3420,19 +5135,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -3442,22 +5170,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -3465,22 +5206,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "primary_category", - "secondary_category", - "marketplace_listing", - "oauth_application", - "oauth_application_id", - "user", - "user_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "secondary_category", + "marketplace_listing", + "oauth_application", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -3488,20 +5242,30 @@ "description": "The ability for members to publish GitHub Pages sites was disabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3510,20 +5274,30 @@ "description": "The ability for members to publish GitHub Pages sites was enabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3532,21 +5306,30 @@ "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3555,22 +5338,30 @@ "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3579,21 +5370,30 @@ "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3602,22 +5402,30 @@ "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3626,19 +5434,30 @@ "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "operation_type", "user_agent", - "actor", - "actor_id", - "business_id", - "@timestamp", - "created_at", - "action" + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3647,18 +5466,29 @@ "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "request_id", - "org", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "actor", "operation_type", - "org_id", - "action", - "@timestamp", "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -3668,22 +5498,31 @@ "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "action", - "org_id", - "user_id", - "business", - "actor_id", "@timestamp", "_document_id", - "request_id", - "user", - "business_id", - "created_at", + "action", "actor", - "org", - "operation_type", - "user_agent" - ], + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, { @@ -3693,16 +5532,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -3711,21 +5561,30 @@ "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "created_at", - "user_id", "business_id", - "user", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "org_id", - "@timestamp" + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -3734,19 +5593,30 @@ "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ - "request_id", - "created_at", - "_document_id", - "user_agent", - "user", - "user_id", - "business", - "business_id", - "operation_type", "@timestamp", + "_document_id", "action", "actor", - "actor_id" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -3755,19 +5625,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3775,21 +5657,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3799,16 +5690,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3818,18 +5722,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3839,77 +5756,124 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", - "operation_type", - "created_at", - "request_access_security_header" - ] - }, - { - "action": "metered_billing_configuration.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { - "action": "metered_billing_configuration.update", + "action": "metered_billing_configuration.destroy", "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "org", - "created_at", - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", - "request_access_security_header" - ] - }, - { - "action": "migration.create", - "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "metered_billing_configuration.update", + "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", + "operation_type" + ] + }, + { + "action": "migration.create", + "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "user_agent", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -3917,16 +5881,30 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "org_id", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3934,24 +5912,32 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", - "repo_id", "operation_type", - "@timestamp", - "user_agent", "created_at", - "org", - "action", - "_document_id", - "repo", - "actor", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3959,15 +5945,28 @@ "description": "A network configuration for a hosted compute service was created.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -3985,15 +5984,28 @@ "description": "A network configuration for a hosted compute service was deleted.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -4006,15 +6018,28 @@ "description": "A network configuration for a hosted compute service was updated.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -4031,20 +6056,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4053,42 +6090,66 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", - "request_id", - "action", - "user", - "request_access_security_header" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.generate_client_secret", - "description": "An OAuth application's secret key was generated.", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" + ], + "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + }, + { + "action": "oauth_application.generate_client_secret", + "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4097,20 +6158,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4119,19 +6192,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4140,20 +6226,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4162,20 +6260,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4184,19 +6294,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4205,17 +6328,28 @@ "description": "An invitation sent to an organization to join an enterprise was accepted.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4226,20 +6360,30 @@ "description": "A billing manager was added to an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "org", - "user_id", "action", - "created_at", - "org_id", - "user", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" }, @@ -4248,21 +6392,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", - "org", - "operation_type", - "request_id", + "action", "actor", - "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", - "user_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -4271,24 +6425,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4296,21 +6460,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -4318,20 +6492,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -4339,22 +6523,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -4362,20 +6554,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -4383,22 +6585,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -4406,19 +6616,30 @@ "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -4427,19 +6648,30 @@ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -4449,17 +6681,30 @@ "description": "Third-party application access for outside collaborators was disabled for the organization.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Limiting OAuth app and GitHub App access requests and installations" }, @@ -4468,15 +6713,28 @@ "description": "Third-party application access for outside collaborators was enabled for the organization.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4487,15 +6745,28 @@ "description": "The organization was archived.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4505,17 +6776,30 @@ "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", "fields": [ - "org_id", - "operation_type", "@timestamp", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" }, @@ -4524,21 +6808,32 @@ "description": "An export of the organization's Git events was created.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "start", "end", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" }, @@ -4547,16 +6842,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_agent", - "action", "@timestamp", - "actor_id", - "org_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -4565,18 +6873,31 @@ "description": "An organization owner blocked a user from accessing the organization's repositories.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", "fields": [ - "actor", - "user_agent", - "org_id", - "created_at", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "blocked_user", + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" }, @@ -4585,19 +6906,30 @@ "description": "An invitation for an organization to join an enterprise was revoked", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "initiated_from" ], "docs_reference_titles": "Adding organizations to your enterprise" @@ -4607,22 +6939,33 @@ "description": "An invitation sent to a user to join an organization was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "email", - "@timestamp", - "actor", - "action", "operation_type", - "user_agent", - "org", "invitation_id", - "_document_id", "created_at", - "invitee_email", - "token_scopes", - "programmatic_access_type" + "invitee_email" ] }, { @@ -4630,19 +6973,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -4650,23 +7004,31 @@ "description": "Autofix for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4674,21 +7036,31 @@ "description": "Autofix for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4696,23 +7068,31 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4720,23 +7100,31 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4744,21 +7132,30 @@ "description": "Code scanning using the default setup was disabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -4767,21 +7164,30 @@ "description": "Code scanning using the default setup was enabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -4790,20 +7196,31 @@ "description": "Access to use Codespaces on internal and private repositories was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "enablement", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "enablement", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization" }, @@ -4812,21 +7229,31 @@ "description": "Ownership and payment for codespaces was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "owner_type", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" }, @@ -4835,16 +7262,29 @@ "description": "A team has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4854,16 +7294,29 @@ "description": "A team has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4873,19 +7326,30 @@ "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -4894,17 +7358,30 @@ "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -4913,21 +7390,30 @@ "description": "A user has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -4935,21 +7421,30 @@ "description": "A user has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -4957,16 +7452,29 @@ "description": "The interaction limit for collaborators only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "request_id", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" @@ -4976,17 +7484,30 @@ "description": "The interaction limit for prior contributors only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "operation_type", "@timestamp", - "created_at", - "user_agent", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", - "actor", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -4995,17 +7516,30 @@ "description": "The interaction limit for existing users only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", "_document_id", - "operation_type", - "actor_id", - "org_id", "action", - "created_at", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5015,16 +7549,29 @@ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ "@timestamp", - "created_at", "_document_id", - "actor_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "action", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5033,17 +7580,30 @@ "description": "The interaction limit for prior contributors only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "operation_type", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5052,17 +7612,30 @@ "description": "The interaction limit for existing users only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "actor_id", - "request_id", + "@timestamp", + "_document_id", "action", - "created_at", - "user_agent", "actor", - "_document_id", - "org_id", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5071,22 +7644,30 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" }, @@ -5095,17 +7676,28 @@ "description": "An invitation for an organization to join an enterprise was confirmed.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5116,15 +7708,28 @@ "description": "Server statistics were exported for the organization.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5135,18 +7740,30 @@ "description": "An organization was created.", "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", "fields": [ - "request_id", - "org", - "actor_id", - "actor", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "org_id", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" }, @@ -5155,20 +7772,31 @@ "description": "A GitHub Actions secret was created for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5177,20 +7805,32 @@ "description": "A GitHub Actions variable was created for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5199,21 +7839,33 @@ "description": "A Codespaces or Dependabot secret was created for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -5221,21 +7873,30 @@ "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor_id", - "org_id", - "business", - "action", "@timestamp", - "org", "_document_id", - "business_id", + "action", "actor", - "token_scopes", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "actor_is_bot", "oauth_credential_type", "managed_oauth_access_id", @@ -5251,24 +7912,32 @@ "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", "fields": [ - "user_agent", - "actor", "@timestamp", - "created_at", - "org_id", - "business_id", - "operation_type", - "request_id", "_document_id", "action", + "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", - "token_scopes", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot", "oauth_credential_type", - "request_access_security_header", "managed_oauth_access_id", "managed_token_id", "managed_oauth_scopes", @@ -5282,21 +7951,32 @@ "description": "An owner revoked authorized credentials.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "oauth_application_id", - "org_id", "operation_type", - "action", - "business", - "request_id", "created_at", - "business_id", - "actor_id", - "_document_id", - "user_agent", "oauth_credential_type", "managed_oauth_access_id", "managed_token_id", @@ -5311,18 +7991,30 @@ "description": "An organization was deleted by a user or staff.", "docs_reference_links": "N/A", "fields": [ - "user_agent", "@timestamp", "_document_id", - "created_at", - "actor", - "org_id", - "org", "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5330,20 +8022,30 @@ "description": "Team creation was limited to owners.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "actor", "@timestamp", "_document_id", - "user", - "user_id", "action", - "created_at", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -5352,16 +8054,29 @@ "description": "Third-party application access restrictions for an organization were disabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "org_id", - "action", - "_document_id", - "request_id", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" @@ -5371,19 +8086,30 @@ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -5392,14 +8118,31 @@ "description": "SAML single sign-on was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sso_url", "issuer", - "action", - "@timestamp", - "_document_id", "created_at", - "org", "operation_type" ] }, @@ -5408,21 +8151,30 @@ "description": "Display of IP addresses within audit log events for the organization was disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" }, @@ -5431,17 +8183,30 @@ "description": "A two-factor authentication requirement was disabled for the organization.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "org_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "_document_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5449,19 +8214,30 @@ "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "user", - "action", - "operation_type", "@timestamp", "_document_id", - "created_at", - "user_agent", - "org", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5469,19 +8245,30 @@ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "user", - "action", - "actor_id", - "org_id" + "created_at" ] }, { @@ -5489,38 +8276,62 @@ "description": "Team creation by members was allowed.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "org_id", - "user", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", - "user_agent", - "actor_id", - "org", - "request_id", "action", - "@timestamp" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" - }, - { - "action": "org.enable_oauth_app_restrictions", - "description": "Third-party application access restrictions for an organization were enabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", - "fields": [ + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", "org", - "created_at", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + }, + { + "action": "org.enable_oauth_app_restrictions", + "description": "Third-party application access restrictions for an organization were enabled.", + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" }, @@ -5529,19 +8340,30 @@ "description": "An organization owner allowed users with read access to create discussions in an organization", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -5550,19 +8372,32 @@ "description": "SAML single sign-on was enabled for the organization.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", - "sso_url", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "@timestamp", - "issuer", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "sso_url", + "created_at", + "issuer" ], "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" }, @@ -5571,21 +8406,30 @@ "description": "Display of IP addresses within audit log events for the organization was enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" }, @@ -5594,17 +8438,30 @@ "description": "Two-factor authentication is now required for the organization.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "actor_id", - "action", - "_document_id", - "org", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" }, @@ -5613,17 +8470,30 @@ "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "org_id", - "manager", "@timestamp", - "request_id", - "actor", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "manager", + "operation_type", "created_at" ] }, @@ -5632,18 +8502,31 @@ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", "docs_reference_links": "N/A", "fields": [ - "org_id", "@timestamp", - "org", - "user_agent", - "request_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "manager", "operation_type", - "created_at", - "_document_id" + "created_at" ] }, { @@ -5651,23 +8534,32 @@ "description": "A new user was invited to join an organization.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", "fields": [ - "org", - "user_id", - "invitation_id", - "org_id", - "user", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", - "created_at", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "invitee_email", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitation_id", + "operation_type", + "created_at", + "invitee_email" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" }, @@ -5676,17 +8568,28 @@ "description": "An organization was invited to join an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5696,19 +8599,30 @@ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -5716,19 +8630,30 @@ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "org", - "org_id", - "user_agent", - "actor_id", - "user_id", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5736,19 +8661,31 @@ "description": "Access to an organization was granted for an OAuth App.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "request_id", "actor_id", - "operation_type", - "org_id", - "_document_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" @@ -5758,20 +8695,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -5780,18 +8728,31 @@ "description": "Access was disabled for an OAuth App that was previously approved.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", "fields": [ - "request_id", - "url", - "created_at", - "org_id", - "action", "@timestamp", "_document_id", - "user_agent", - "org", - "operation_type", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", + "operation_type", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" @@ -5801,19 +8762,31 @@ "description": "An organization member requested that an owner grant an OAuth App access to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", + "@timestamp", "_document_id", - "request_id", - "url", - "org_id", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "url", "oauth_application_name" ] }, @@ -5822,20 +8795,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -5845,16 +8829,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "org_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type", - "_document_id", - "org" + "created_at", + "operation_type" ] }, { @@ -5862,20 +8859,31 @@ "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "reason", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "reason", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -5884,20 +8892,30 @@ "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "request_access_security_header" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -5906,19 +8924,30 @@ "description": "An organization owner downloaded the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -5927,19 +8956,30 @@ "description": "An organization owner generated the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -5948,19 +8988,30 @@ "description": "An organization owner printed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -5969,19 +9020,30 @@ "description": "An organization owner viewed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -5990,19 +9052,31 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", "fields": [ - "actor", - "operation_type", "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "actor_is_bot", - "request_access_security_header" + "operation_type", + "created_at", + "actor_is_bot" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -6011,20 +9085,31 @@ "description": "A GitHub Actions secret was removed from an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -6033,21 +9118,31 @@ "description": "A GitHub Actions variable was removed from an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -6056,18 +9151,29 @@ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "user_id", - "user_agent", - "org_id", - "user", - "action", - "_document_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" @@ -6077,44 +9183,63 @@ "description": "A Codespaces or Dependabot secret was removed from an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "key", - "integration", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes" - ] - }, - { - "action": "org.remove_member", - "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A", - "fields": [ - "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", - "action", - "user_id", - "@timestamp", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "org_id", + "created_at" + ] + }, + { + "action": "org.remove_member", + "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6122,21 +9247,30 @@ "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ - "org", - "user", - "org_id", - "created_at", - "request_id", "@timestamp", - "action", - "operation_type", - "user_agent", "_document_id", + "action", "actor", "actor_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6144,21 +9278,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -6166,18 +9310,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", "fields": [ - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "actor", - "action", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -6186,19 +9342,31 @@ "description": "An organization was renamed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "_document_id", "@timestamp", - "org", + "_document_id", "action", "actor", - "old_login", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_login", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -6206,14 +9374,28 @@ "description": "Triggered when a required workflow is created.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6224,14 +9406,28 @@ "description": "Triggered when a required workflow is deleted.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6242,14 +9438,28 @@ "description": "Triggered when a required workflow is updated.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6260,20 +9470,30 @@ "description": "An organization member was restored.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", "fields": [ - "user", - "actor", - "user_id", + "@timestamp", "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "actor_id", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" }, @@ -6282,18 +9502,29 @@ "description": "A member's linked identity was revoked.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", "user_id", - "@timestamp", - "action", - "actor_id", "user_agent", - "_document_id", - "request_id", + "operation_type", "created_at" ], "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" @@ -6303,19 +9534,30 @@ "description": "A member's SAML session was revoked.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", "fields": [ - "actor_id", - "created_at", - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" }, @@ -6324,21 +9566,33 @@ "description": "A self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" @@ -6348,21 +9602,31 @@ "description": "A self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6371,20 +9635,31 @@ "description": "A self-hosted runner group was renamed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6393,23 +9668,33 @@ "description": "The REST API was used to remove a self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -6418,23 +9703,31 @@ "description": "A self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6443,19 +9736,32 @@ "description": "A runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -6464,25 +9770,36 @@ "description": "The configuration of a self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6491,21 +9808,32 @@ "description": "The visibility of a self-hosted runner group was updated via the REST API.", "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", - "visibility", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" }, @@ -6514,21 +9842,30 @@ "description": "Automatic partner validation checks have been disabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -6538,21 +9875,30 @@ "description": "Automatic partner validation checks have been enabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -6562,20 +9908,30 @@ "description": "A custom pattern was created for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6584,22 +9940,30 @@ "description": "A custom pattern was removed from secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6608,21 +9972,30 @@ "description": "A custom pattern was published for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6631,21 +10004,30 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6654,22 +10036,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6678,21 +10068,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6701,22 +10100,30 @@ "description": "Generic secrets have been disabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -6724,22 +10131,30 @@ "description": "Generic secrets have been enabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -6747,21 +10162,30 @@ "description": "Secret scanning for non-provider patterns was disabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -6771,21 +10195,30 @@ "description": "Secret scanning for non-provider patterns was enabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -6795,19 +10228,30 @@ "description": "A role or team was added to the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -6817,21 +10261,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -6841,21 +10294,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -6865,19 +10327,30 @@ "description": "A role or team was removed from the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -6887,22 +10360,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -6911,22 +10392,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -6935,22 +10424,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -6959,21 +10456,30 @@ "description": "Push protection for secret scanning was disabled.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -6982,21 +10488,30 @@ "description": "Push protection for secret scanning was enabled.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7005,22 +10520,30 @@ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7029,22 +10552,30 @@ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7053,26 +10584,35 @@ "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -7081,26 +10621,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7108,28 +10656,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7137,26 +10693,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7164,15 +10728,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -7181,15 +10762,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -7198,7 +10796,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -7213,20 +10832,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -7235,16 +10865,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -7255,18 +10898,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -7275,17 +10931,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", "_document_id", - "org_id", - "operation_type", + "action", "actor", "actor_id", - "@timestamp", - "request_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", - "action" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7293,18 +10962,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -7313,18 +10994,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -7333,18 +11027,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -7353,22 +11059,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", "actor_id", - "org_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issuer", - "business", "operation_type", "created_at", - "request_id", - "business_id", - "_document_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7376,21 +11092,32 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Adding organizations to your enterprise" }, @@ -7399,19 +11126,30 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -7422,15 +11160,28 @@ "description": "The organization was unarchived.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7440,19 +11191,32 @@ "description": "A user was unblocked from an organization.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", "fields": [ - "oauth_application_id", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", - "@timestamp", - "request_id", - "created_at", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "blocked_user", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" }, @@ -7461,20 +11225,32 @@ "description": "A GitHub Actions secret was updated for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "created_at", "key", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -7483,23 +11259,34 @@ "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "updated_allowed_types", "old_policy", - "updated_access_policy", - "programmatic_access_type", - "request_access_security_header" + "updated_access_policy" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" }, @@ -7508,20 +11295,32 @@ "description": "A GitHub Actions variable was updated for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -7530,20 +11329,32 @@ "description": "The default repository permission level for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", + "created_at", "permission", - "actor_id", - "old_permission", - "_document_id", - "programmatic_access_type" + "old_permission" ] }, { @@ -7551,22 +11362,33 @@ "description": "A Codespaces or Dependabot secret was updated for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "visibility", - "integration", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "visibility", + "integration", + "operation_type", + "created_at" ] }, { @@ -7575,20 +11397,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -7596,17 +11429,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -7616,20 +11462,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -7638,17 +11495,30 @@ "description": "The name of the default branch was changed for new repositories in the organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" }, @@ -7657,17 +11527,30 @@ "description": "The repository self-hosted runners policy was updated", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_repo_runners_policy", "new_repo_runners_policy", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -7678,19 +11561,32 @@ "description": "An organization's SAML provider settings were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "sso_url", - "actor_id", - "operation_type", "@timestamp", - "issuer", - "org", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "operation_type", + "issuer", + "created_at" ] }, { @@ -7698,18 +11594,30 @@ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", "fields": [ - "request_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "_document_id", - "org", - "action", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" }, @@ -7718,18 +11626,30 @@ "description": "A default label was created for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", "fields": [ - "request_id", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", - "_document_id", - "action", - "created_at", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" }, @@ -7738,17 +11658,30 @@ "description": "A default label was deleted for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", "fields": [ - "operation_type", - "request_id", - "actor", "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" }, @@ -7757,17 +11690,30 @@ "description": "A default label was edited for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", "fields": [ - "org", - "created_at", "@timestamp", - "actor", + "_document_id", "action", - "user_agent", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" }, @@ -7776,20 +11722,33 @@ "description": "A domain was approved for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "org_id", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" }, @@ -7798,16 +11757,31 @@ "description": "A domain was added to an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "created_at", + "@timestamp", "_document_id", - "domain_name", "action", - "request_id", + "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "domain_name", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -7816,14 +11790,29 @@ "description": "A domain was removed from an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", "fields": [ - "action", - "domain_name", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "domain_name", "operation_type", "created_at" ], @@ -7834,16 +11823,31 @@ "description": "A domain was verified for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "operation_type", - "domain_name", "@timestamp", - "user_agent", - "request_id", - "actor", - "action", - "created_at", "_document_id", - "actor_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "domain_name", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -7852,16 +11856,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -7871,17 +11888,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7891,16 +11919,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -7910,20 +11951,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -7931,40 +11982,62 @@ "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor", - "business_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", "user_agent", - "_document_id", "created_at", - "operation_type", - "request_id", - "business" + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, { "action": "organization_projects_change.disable", "description": "Organization projects were disabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", - "fields": [ - "org_id", - "action", - "user", - "org", - "created_at", - "user_agent", - "request_id", - "actor_id", - "operation_type", + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -7973,18 +12046,29 @@ "description": "Organization projects were enabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor_id", - "org_id", - "created_at", - "user_id", - "org", "@timestamp", "_document_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", + "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" @@ -7994,23 +12078,33 @@ "description": "An organization role was assigned to a user or team.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About custom organization roles" }, @@ -8019,25 +12113,32 @@ "description": "A custom organization role was created in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8049,25 +12150,32 @@ "description": "A custom organization role was deleted in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8078,19 +12186,30 @@ "description": "A user or team was unassigned an organization role.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type" ], @@ -8101,26 +12220,33 @@ "description": "A custom organization role was edited in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", "old_role_permissions", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -8133,22 +12259,33 @@ "description": "An organization's default project base role was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_project_base_role", - "new_project_base_role", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_project_base_role", + "new_project_base_role", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8156,20 +12293,31 @@ "description": "An entire package was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" @@ -8179,23 +12327,34 @@ "description": "A package was published or republished to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "ecosystem", "version_count", "is_republished", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -8204,21 +12363,32 @@ "description": "A specific package version was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "version", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "ecosystem", "actor_is_bot" ], @@ -8229,21 +12399,34 @@ "description": "A specific package version was published or republished to a package.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "ecosystem", "package", "version", - "actor_id", - "user_agent", "is_republished", - "actor", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -8252,20 +12435,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -8274,17 +12471,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8295,20 +12507,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -8317,18 +12543,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8336,16 +12574,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8353,18 +12605,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8372,18 +12636,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8394,22 +12671,31 @@ "description": "The configured restriction for access to resources via personal access tokens was disabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "programmatic_access_type", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8417,22 +12703,31 @@ "description": "The configured restriction for access to resources via personal access tokens was enabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8440,18 +12735,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8462,18 +12770,28 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -8484,18 +12802,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -8506,23 +12834,34 @@ "description": "A personal access token expiration limit was set.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "token_expiration", "old_token_expiration", "exempt_administrators", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8530,21 +12869,32 @@ "description": "A personal access token expiration limit was unset.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "programmatic_access_type", - "old_token_expiration", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_token_expiration", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8552,17 +12902,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8573,18 +12936,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8596,17 +12972,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8618,20 +13007,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was created.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "branch", - "repository", - "repository_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -8643,20 +13041,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -8668,20 +13075,29 @@ "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -8693,20 +13109,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -8718,15 +13143,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8736,17 +13176,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -8756,15 +13207,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8774,19 +13240,30 @@ "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "action", - "operation_type", "@timestamp", - "business_id", + "_document_id", + "action", + "actor", "actor_id", - "user", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8794,23 +13271,30 @@ "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "created_at", - "actor_id", + "@timestamp", "_document_id", - "actor", - "user", - "repo", "action", - "user_agent", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "request_id", - "user_id", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8818,23 +13302,30 @@ "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_id", - "operation_type", + "@timestamp", "_document_id", "action", - "@timestamp", - "repo", - "org", - "business", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org_id", - "created_at", - "business_id" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8842,17 +13333,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8862,17 +13364,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8882,17 +13395,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8902,17 +13426,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -8922,17 +13457,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -8942,17 +13490,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8960,25 +13521,36 @@ "description": "A project's base role was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_project_base_role", "new_project_base_role", "project_number", "public_project", - "business", "project_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8986,20 +13558,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -9009,25 +13592,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -9035,20 +13630,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9056,25 +13663,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9082,17 +13701,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -9100,17 +13732,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -9118,18 +13763,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -9138,18 +13795,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -9158,19 +13827,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -9178,17 +13858,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -9200,22 +13893,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -9223,19 +13925,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -9243,17 +13956,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", - "org_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9261,18 +13987,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -9280,20 +14019,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9301,18 +14050,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -9321,18 +14082,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -9341,16 +14114,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -9362,21 +14148,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -9384,22 +14182,32 @@ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", "fields": [ - "repo", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "name", "created_at", - "_document_id", "operation_type", - "actor", - "repo_id", - "org", - "request_id", - "actor_id", - "oauth_application_id", - "@timestamp", - "programmatic_access_type" + "oauth_application_id" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" }, @@ -9408,29 +14216,34 @@ "description": "A protected branch allowance was given to a specific user, team or integration.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "authorized_actors", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -9438,24 +14251,32 @@ "description": "Branch protection was enabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", "user_agent", - "repo", + "operation_type", "name", - "org_id", - "user", - "_document_id", - "request_id", - "actor", - "actor_id", - "org", - "action", "created_at", "authorized_actor_names", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -9466,21 +14287,31 @@ "description": "Branch protection was disabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "repo", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", - "request_id", - "repo_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "name", + "operation_type", "created_at", - "_document_id", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -9491,22 +14322,32 @@ "description": "Enforcement of dismissing stale pull requests was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "dismiss_stale_reviews_on_push", - "org_id", - "action", - "created_at", - "request_id", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismiss_stale_reviews_on_push", + "created_at", "operation_type", - "actor", - "repo", - "org", - "name", - "programmatic_access_type" + "name" ] }, { @@ -9514,24 +14355,34 @@ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "authorized_actors_only", "authorized_actors", "created_at", - "user_agent", "name", - "_document_id", - "org_id", - "request_id", - "@timestamp", - "actor_id", - "org", - "action", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -9539,30 +14390,37 @@ "description": "A branch protection requirement was overridden by a repository administrator.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "actor", "reasons", - "@timestamp", "before", "after", - "actor_id", - "repo", "operation_type", - "user_agent", "branch", "overridden_codes", - "org", - "org_id", - "action", - "_document_id", - "request_id", "referrer", - "business", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "rule_suite_id" ] @@ -9572,28 +14430,36 @@ "description": "A branch update attempt was rejected.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "request_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "branch", "before", "overridden_codes", "after", - "action", "reasons", - "actor_id", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "actor_is_bot", "rule_suite_id" @@ -9604,23 +14470,32 @@ "description": "Branch protection was enforced for repository administrators.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "admin_enforced", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "name", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "action", "repo_id", - "org_id", - "_document_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "admin_enforced", + "operation_type", + "name", + "created_at" ] }, { @@ -9628,22 +14503,32 @@ "description": "Branch deletion was enabled or disabled for a protected branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "operation_type", - "request_id", - "repo", "@timestamp", - "org_id", - "org", - "action", - "allow_deletions_enforcement_level", "_document_id", - "created_at", - "actor_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_deletions_enforcement_level", + "created_at" ] }, { @@ -9651,23 +14536,32 @@ "description": "Force pushes were enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "actor_id", - "name", + "@timestamp", "_document_id", + "action", "actor", - "repo", - "operation_type", - "request_id", - "allow_force_pushes_enforcement_level", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_force_pushes_enforcement_level", + "created_at" ] }, { @@ -9675,24 +14569,33 @@ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "ignore_approvals_from_contributors", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -9701,22 +14604,32 @@ "description": "Required linear commit history was enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "operation_type", "actor", - "linear_history_requirement_enforcement_level", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "linear_history_requirement_enforcement_level", "name", - "org_id", - "repo_id", - "org", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ] }, { @@ -9724,24 +14637,33 @@ "description": "Fork syncing was enabled or disabled for a read-only branch", "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "lock_allows_fetch_and_merge", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -9750,27 +14672,34 @@ "description": "The enforcement of a branch lock was updated.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "enforcement_level", "lock_branch_enforcement_level", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -9779,18 +14708,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9801,24 +14743,33 @@ "description": "A branch name pattern was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "old_name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "old_name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -9826,25 +14777,32 @@ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", "docs_reference_links": "N/A", "fields": [ - "name", - "org_id", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "@timestamp", + "business", "business_id", - "request_id", - "pull_request_reviews_enforcement_level", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "business", - "user_agent", - "created_at", "repo_id", - "operation_type", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "pull_request_reviews_enforcement_level", + "created_at", + "operation_type" ] }, { @@ -9852,22 +14810,32 @@ "description": "Enforcement of required code owner review was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "created_at", - "require_code_owner_review", - "operation_type", - "name", - "user_agent", - "action", "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "request_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "require_code_owner_review", + "operation_type", + "name" ] }, { @@ -9875,22 +14843,33 @@ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "require_last_push_approval", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" }, @@ -9899,22 +14878,32 @@ "description": "Enforcement of the required number of approvals before merging was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "required_approving_review_count", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "required_approving_review_count", "created_at", - "actor", "operation_type", - "user_agent", - "name", - "org_id", - "action", - "actor_id", - "_document_id", - "org", - "@timestamp", - "programmatic_access_type" + "name" ] }, { @@ -9922,25 +14911,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "user_agent", "@timestamp", "_document_id", - "name", - "repo", "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "business", - "actor_id", - "operation_type", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "required_status_checks_enforcement_level", - "org", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "required_status_checks_enforcement_level" ] }, { @@ -9948,22 +14944,32 @@ "description": "Enforcement of required commit signing was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "name", "@timestamp", - "created_at", "_document_id", - "request_id", - "repo_id", - "org", - "org_id", "action", "actor", "actor_id", - "signature_requirement_enforcement_level", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "programmatic_access_type" + "operation_type", + "name", + "created_at", + "signature_requirement_enforcement_level" ] }, { @@ -9971,22 +14977,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "created_at", - "repo_id", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "name", - "actor", - "repo", "operation_type", - "action", - "strict_required_status_checks_policy", - "programmatic_access_type" + "strict_required_status_checks_policy" ] }, { @@ -9994,23 +15010,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -10019,24 +15046,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -10045,20 +15083,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10067,21 +15119,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -10091,22 +15156,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10115,25 +15192,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10142,23 +15229,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", "key", "fingerprint", - "actor_id", - "actor", "title", - "user_agent", - "user_id", - "request_id", - "read_only", - "token_scopes", - "programmatic_access_type" + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10167,18 +15265,32 @@ "description": "A pull request was closed without being merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" @@ -10188,21 +15300,32 @@ "description": "A pull request was converted to a draft.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" }, @@ -10211,19 +15334,32 @@ "description": "A pull request was created.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -10234,23 +15370,35 @@ "description": "A review was requested on a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -10260,17 +15408,31 @@ "description": "A pull request was marked as in progress.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -10278,19 +15440,32 @@ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -10298,19 +15473,32 @@ "description": "A pull request was merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" @@ -10320,21 +15508,32 @@ "description": "A pull request was marked as ready for review.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" }, @@ -10343,27 +15542,34 @@ "description": "A pull request was rebased.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "pull_request_url", "pull_request_title", - "user", - "user_id", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -10371,23 +15577,35 @@ "description": "A review request was removed from a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" }, @@ -10396,18 +15614,32 @@ "description": "A pull request was reopened after previously being closed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -10415,19 +15647,31 @@ "description": "A review comment was added to a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "comment_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -10437,20 +15681,31 @@ "description": "A review comment on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", "@timestamp", "_document_id", - "repo", - "created_at", - "request_id", - "comment_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "comment_id", + "operation_type" ] }, { @@ -10458,18 +15713,31 @@ "description": "A review comment on a pull request was changed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "request_id", - "actor_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "_document_id", - "@timestamp", - "comment_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "comment_id" ] }, { @@ -10477,21 +15745,33 @@ "description": "A review on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ] }, { @@ -10499,20 +15779,33 @@ "description": "A review on a pull request was dismissed.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" }, @@ -10521,19 +15814,33 @@ "description": "A review on a pull request was submitted.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" @@ -10543,22 +15850,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -10567,21 +15884,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -10590,25 +15916,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -10617,23 +15950,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -10642,24 +15983,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -10668,23 +16016,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -10694,43 +16050,65 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "visibility", + "visibility" + ], + "docs_reference_titles": "/repositories/archiving-a-github-repository" + }, + { + "action": "repo.change_merge_setting", + "description": "Pull request merge options were changed for a repository.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" - ], - "docs_reference_titles": "/repositories/archiving-a-github-repository" - }, - { - "action": "repo.change_merge_setting", - "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "actor", - "oauth_application_id", + "user", + "user_id", "user_agent", - "request_id", + "oauth_application_id", "created_at", - "@timestamp", - "_document_id", - "actor_id", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -10739,24 +16117,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -10765,24 +16153,32 @@ "description": "Autofix for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -10790,24 +16186,32 @@ "description": "Autofix for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -10815,24 +16219,32 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -10840,24 +16252,32 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -10865,23 +16285,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -10892,25 +16321,31 @@ "description": "Code scanning using the default setup was disabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -10919,26 +16354,34 @@ "description": "Code scanning using the default setup was enabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "query_suite", "threat_model", - "languages", - "request_access_security_header" + "languages" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -10947,25 +16390,34 @@ "description": "Code scanning using the default setup was updated for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "query_suite", "threat_model", "languages", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Configuring default setup for code scanning" @@ -10975,19 +16427,30 @@ "description": "GitHub Codespaces was granted trusted repository access to this repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -10996,19 +16459,30 @@ "description": "GitHub Codespaces trusted repository access to this repository was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11016,17 +16490,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11035,15 +16522,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -11054,16 +16554,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11073,17 +16586,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11093,19 +16619,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11114,45 +16651,64 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", - "created_at", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + }, + { + "action": "repo.configure_self_hosted_jit_runner", + "description": "A new just-in-time GitHub Actions self-hosted runner was configured", + "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.configure_self_hosted_jit_runner", - "description": "A new just-in-time GitHub Actions self-hosted runner was configured", - "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", - "fields": [ - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "hashed_token", - "programmatic_access_type", - "actor", - "actor_id", - "oauth_application_id", "token_id", "token_scopes", - "repo", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -11161,30 +16717,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -11194,20 +16755,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -11216,25 +16788,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -11243,23 +16823,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -11267,25 +16858,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -11295,23 +16895,32 @@ "description": "A source code archive of a repository was downloaded as a ZIP file.", "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "created_at", "operation_type", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" @@ -11321,23 +16930,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -11345,21 +16964,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -11367,21 +16996,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -11389,22 +17028,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -11412,21 +17060,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -11434,20 +17092,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11455,22 +17124,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -11478,18 +17156,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -11497,22 +17189,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -11520,40 +17222,62 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", - "fields": [ - "actor_id", - "repo", - "operation_type", - "action", + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -11562,22 +17286,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -11586,24 +17319,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -11612,23 +17353,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -11636,26 +17387,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -11664,21 +17420,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -11687,25 +17452,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -11713,22 +17484,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -11737,25 +17518,34 @@ "description": "A branch was renamed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "old_branch", - "new_branch", - "default_branch", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "old_branch", + "new_branch", + "default_branch", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch" @@ -11765,19 +17555,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -11785,17 +17586,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -11804,17 +17620,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -11823,7 +17654,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -11838,23 +17690,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -11864,20 +17725,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -11888,21 +17760,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -11911,22 +17794,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -11935,21 +17828,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -11958,22 +17862,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -11984,16 +17898,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -12003,22 +17928,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -12027,23 +17963,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -12053,19 +17999,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -12073,21 +18029,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -12096,24 +18062,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -12121,25 +18096,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12148,24 +18130,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12174,25 +18166,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12201,22 +18201,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12225,26 +18234,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -12252,31 +18269,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12285,22 +18309,30 @@ "description": "Someone closed a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", "fields": [ - "actor", - "repo", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "user_agent", - "actor_id", - "request_id", - "action", - "operation_type", - "created_at", - "repo_id", - "_document_id", + "hashed_token", "org", "org_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "About repository security advisories" }, @@ -12309,18 +18341,29 @@ "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "repo", - "org_id", - "actor", + "@timestamp", + "_document_id", "action", - "request_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "_document_id", + "operation_type", "created_at" ] }, @@ -12329,17 +18372,30 @@ "description": "GitHub made a security advisory public in the GitHub Advisory Database.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -12348,21 +18404,30 @@ "description": "GitHub withdrew a security advisory that was published in error.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -12370,18 +18435,30 @@ "description": "Someone opened a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", "repo_id", - "action", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -12389,21 +18466,30 @@ "description": "Someone published a security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", "@timestamp", - "actor", - "repo_id", "_document_id", - "repo", - "business_id", - "business", - "request_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "org" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -12411,17 +18497,30 @@ "description": "Someone reopened as draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "repo", - "action", - "created_at", "@timestamp", - "request_id", - "actor_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "public_repo" ] }, @@ -12430,21 +18529,30 @@ "description": "Someone edited a draft or published security advisory.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "repo_id", - "org_id", "business", - "actor", - "user_agent", - "created_at", - "_document_id", "business_id", - "repo", - "action", - "operation_type", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -12452,24 +18560,30 @@ "description": "Branch protections were disabled for the repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -12478,24 +18592,30 @@ "description": "Branch protections were enabled for this repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -12504,19 +18624,30 @@ "description": "Data use settings were disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "repo_id", - "request_id", - "actor_id", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -12525,21 +18656,30 @@ "description": "Data use settings were enabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "org", - "user_id", - "repo_id", "@timestamp", - "request_id", - "actor", + "_document_id", "action", - "operation_type", - "created_at", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org_id", - "_document_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -12548,23 +18688,30 @@ "description": "The dependency graph was disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "repo_id", - "operation_type", - "user_id", - "repo", + "@timestamp", "_document_id", - "actor", - "user", "action", - "@timestamp", - "org_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", - "request_id", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -12573,24 +18720,31 @@ "description": "The dependency graph was enabled for a private repository.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor_id", - "repo_id", + "created_at", "operation_type", - "actor", - "@timestamp", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12599,21 +18753,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -12621,21 +18785,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -12643,21 +18817,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -12665,20 +18850,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -12686,21 +18883,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -12708,19 +18916,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -12728,19 +18949,30 @@ "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", "fields": [ - "request_id", - "created_at", + "@timestamp", "_document_id", "action", - "user_agent", - "user", - "business_id", - "business", - "operation_type", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -12749,20 +18981,30 @@ "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "created_at", "@timestamp", - "repo", - "action", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "repo_id", - "actor", - "request_id", - "programmatic_access_type" + "created_at", + "operation_type" ] }, { @@ -12771,20 +19013,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", "created_at", - "org_id", - "action", - "user_id", - "operation_type", - "_document_id", - "actor_id", - "repo" + "operation_type" ] }, { @@ -12792,31 +19043,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -12825,19 +19084,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -12845,8 +19115,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -12855,23 +19124,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -12896,26 +19174,32 @@ "description": "Automatic partner validation checks have been disabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -12924,26 +19208,32 @@ "description": "Automatic partner validation checks have been enabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -12952,23 +19242,30 @@ "description": "A custom pattern was created for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -12978,23 +19275,30 @@ "description": "A custom pattern was removed from secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13004,24 +19308,31 @@ "description": "A custom pattern was published for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13031,24 +19342,31 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -13057,24 +19375,31 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13084,23 +19409,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13110,23 +19442,31 @@ "description": "Secret scanning was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "public_repo", - "programmatic_access_type" + "public_repo" ], "docs_reference_titles": "About secret scanning" }, @@ -13135,22 +19475,30 @@ "description": "Secret scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13158,24 +19506,32 @@ "description": "Generic secrets have been disabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13183,22 +19539,31 @@ "description": "Generic secrets have been enabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -13207,24 +19572,32 @@ "description": "Secret scanning for non-provider patterns was disabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -13233,24 +19606,32 @@ "description": "Secret scanning for non-provider patterns was enabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -13259,19 +19640,31 @@ "description": "A role or team was added to the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -13280,24 +19673,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -13306,24 +19707,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -13332,19 +19741,31 @@ "description": "A role or team was removed from the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -13353,26 +19774,31 @@ "description": "Secret scanning push protection was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -13381,26 +19807,31 @@ "description": "Secret scanning push protection was enabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -13409,28 +19840,36 @@ "description": "A code security configuration was applied to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13438,27 +19877,35 @@ "description": "A code security configuration failed to attach to the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13466,28 +19913,36 @@ "description": "A code security configuration was removed from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13495,28 +19950,36 @@ "description": "A code security configuration was removed due to a change in repository or enterprise settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "operation_type", + "actor_is_bot" ] }, { @@ -13524,20 +19987,30 @@ "description": "The repository visibility change setting was cleared for an organization or enterprise.", "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", "fields": [ - "created_at", + "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", "business", - "action", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business_id", - "@timestamp", "user_agent", - "actor", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise" }, @@ -13546,20 +20019,30 @@ "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user", - "org_id", - "created_at", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "_document_id", - "@timestamp", - "user_id", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13567,19 +20050,30 @@ "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "_document_id", "@timestamp", - "user_agent", - "user", - "created_at", - "org", - "org_id", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13587,29 +20081,37 @@ "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -13618,29 +20120,37 @@ "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -13649,19 +20159,32 @@ "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ - "operation_type", - "request_id", - "repo_id", "@timestamp", - "user_agent", - "alert_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "alert_id", + "created_at", + "alert_number" ], "docs_reference_titles": "About Dependabot alerts" }, @@ -13670,23 +20193,32 @@ "description": "A Dependabot alert was manually dismissed.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "operation_type", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "alert_id", - "actor", - "repo", "created_at", - "org", - "_document_id", - "action", - "actor_id", "dismiss_reason", - "user", "dismiss_comment", "alert_number", "actor_is_bot" @@ -13697,49 +20229,69 @@ "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "public_repo", "owner", - "_document_id", - "@timestamp", "operation_type", + "alert_number" + ] + }, + { + "action": "repository_vulnerability_alert.reopen", + "description": "A Dependabot alert was manually reopened.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number" - ] - }, - { - "action": "repository_vulnerability_alert.reopen", - "description": "A Dependabot alert was manually reopened.", - "docs_reference_links": "N/A", - "fields": [ + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", "alert_id", "created_at", - "action", - "repo", - "repo_id", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type", - "business", - "business_id", "public_repo", - "alert_number", - "request_access_security_header" + "alert_number" ] }, { @@ -13747,21 +20299,32 @@ "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", "docs_reference_links": "N/A", "fields": [ - "alert_id", - "repo", - "operation_type", - "action", - "repo_id", - "_document_id", - "user_agent", - "request_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "alert_id", + "operation_type", + "created_at", + "alert_number" ] }, { @@ -13769,21 +20332,35 @@ "description": "A Dependabot alert was withdrawn.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", "created_at", "active", - "action", - "repository_id", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type" ] }, @@ -13792,20 +20369,30 @@ "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", "fields": [ - "org", + "@timestamp", "_document_id", - "repo", - "org_id", - "operation_type", - "created_at", - "actor", "action", - "@timestamp", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" }, @@ -13814,24 +20401,31 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -13839,26 +20433,32 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13866,23 +20466,30 @@ "description": "Dependabot alerts was disabled.", "docs_reference_links": "N/A", "fields": [ - "repo", - "request_id", - "repo_id", - "action", - "actor_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "_document_id", "user_id", - "operation_type", - "token_scopes", - "programmatic_access_type" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13890,23 +20497,30 @@ "description": "Dependabot alerts was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_agent", - "created_at", "@timestamp", - "repo_id", + "_document_id", "action", - "user", - "repo", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor_id", - "_document_id", - "user_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot" ] }, @@ -13915,24 +20529,31 @@ "description": "A status check was marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "org", - "actor_id", "@timestamp", - "business", - "request_id", - "context", - "repo_id", - "action", - "repo", "_document_id", - "operation_type", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "actor", - "created_at", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "context", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -13941,21 +20562,31 @@ "description": "A status check was no longer marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "actor_id", - "actor", - "created_at", - "context", - "operation_type", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "repo_id", "org_id", - "action", - "_document_id", + "programmatic_access_type", "repo", - "programmatic_access_type" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "context", + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -13964,18 +20595,31 @@ "description": "Email notification restrictions for an organization or enterprise were disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -13984,19 +20628,31 @@ "description": "Email notification restrictions for an organization or enterprise were enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -14005,22 +20661,33 @@ "description": "A new custom repository role was created.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "owner", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", - "_document_id", "role_permissions", "old_role_permissions" ], @@ -14031,23 +20698,34 @@ "description": "A custom repository role was deleted.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Managing custom repository roles for an organization" }, @@ -14056,23 +20734,34 @@ "description": "A custom repository role was edited.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "old_role_permissions", "old_base_role" ], @@ -14083,14 +20772,28 @@ "description": "GitHub detected a secret and created a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -14104,14 +20807,28 @@ "description": "A secret scanning alert was leaked in a public repo.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -14126,22 +20843,32 @@ "description": "A secret scanning alert was reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type_display_name" ] }, @@ -14150,14 +20877,28 @@ "description": "A leaked secret was reported to the secret's provider by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "created_at", @@ -14172,28 +20913,37 @@ "description": "A secret scanning alert was resolved.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "resolution", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", + "resolution", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type", "secret_type_display_name", "publicly_leaked", - "multi_repo", - "request_access_security_header" + "multi_repo" ] }, { @@ -14201,25 +20951,32 @@ "description": "A secret scanning alert was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -14227,14 +20984,28 @@ "description": "A secret scanning alert was validated.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "previous_validity", @@ -14251,19 +21022,30 @@ "description": "Secret scanning was disabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -14272,19 +21054,30 @@ "description": "Secret scanning was enabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -14293,20 +21086,30 @@ "description": "Secret scanning was disabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -14315,19 +21118,30 @@ "description": "Secret scanning was enabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -14336,14 +21150,28 @@ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "push_protection_bypass_reason", @@ -14361,25 +21189,33 @@ "description": "A request to bypass secret scanning push protection was approved by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -14388,25 +21224,33 @@ "description": "A request to bypass secret scanning push protection was denied by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", - "request_access_security_header", "request_reviewer_comment" ], "docs_reference_titles": "About push protection" @@ -14416,25 +21260,33 @@ "description": "A user requested to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" }, @@ -14443,10 +21295,28 @@ "description": "A security configuration was created", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -14461,15 +21331,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -14487,22 +21350,33 @@ "description": "A default security configuration setting for new repositories was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14511,22 +21385,33 @@ "description": "A default security configuration setting for new repositories was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14535,10 +21420,28 @@ "description": "A security configuration was deleted", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -14553,15 +21456,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -14578,15 +21474,30 @@ "description": "A security configuration policy was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enforcement", "security_configuration_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14596,10 +21507,28 @@ "description": "A security configuration was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -14614,15 +21543,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -14640,16 +21562,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14659,18 +21594,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -14679,16 +21627,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14698,15 +21659,28 @@ "description": "An agreement for invoiced billing for GitHub Sponsors was signed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -14718,15 +21692,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -14736,15 +21723,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -14753,17 +21755,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -14772,17 +21787,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -14791,16 +21820,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -14810,14 +21852,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -14827,17 +21884,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -14845,18 +21915,31 @@ "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", - "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", + "fields": [ "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -14865,18 +21948,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -14885,15 +21981,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -14903,16 +22013,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14920,15 +22043,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -14939,16 +22075,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -14958,17 +22107,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -14979,17 +22141,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -15000,18 +22175,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15021,16 +22207,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15040,16 +22239,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15061,17 +22273,30 @@ "fields": [ "@timestamp", "_document_id", - "fingerprint", - "operation_type", - "openssh_public_key", - "org_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "request_id" + "fingerprint", + "operation_type", + "openssh_public_key", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15080,19 +22305,32 @@ "description": "An SSH certificate authority for an organization or enterprise was deleted.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "created_at", + "@timestamp", "_document_id", - "fingerprint", - "operation_type", + "action", "actor", - "org_id", - "openssh_public_key", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", - "request_id" + "created_at", + "fingerprint", + "operation_type", + "openssh_public_key" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15101,21 +22339,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "user", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "request_id", - "org", - "org_id", - "created_at", - "actor", "action", - "user_id", + "actor", + "actor_id", "business", "business_id", - "@timestamp", - "actor_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15124,19 +22371,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "actor_id", - "user_id", - "org", - "operation_type", - "request_id", "@timestamp", "_document_id", - "actor", - "user", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15145,15 +22403,28 @@ "description": "Dependabot encrypted config was read.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "public_repo" @@ -15164,20 +22435,34 @@ "description": "The verification code expiry time for an organization or enterprise domain was set.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "token_expires_at", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15185,18 +22470,33 @@ "description": "An organization or enterprise domain was unverified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ] }, { @@ -15204,16 +22504,31 @@ "description": "An organization or enterprise domain was verified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "domain_name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15221,23 +22536,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15245,23 +22570,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15269,23 +22604,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15293,23 +22638,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15317,21 +22672,31 @@ "description": "A member of an organization was added to a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", "fields": [ - "user_agent", - "request_id", - "org_id", - "user_id", - "team", - "user", "@timestamp", - "actor_id", - "created_at", - "operation_type", "_document_id", - "org", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" @@ -15341,22 +22706,31 @@ "description": "A team was given access and permissions to a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "team", - "action", - "operation_type", - "request_id", - "created_at", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "actor_id", - "_document_id", "repo_id", - "user_agent", - "org_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -15365,20 +22739,31 @@ "description": "A child team was created or a child team's parent was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", "fields": [ - "org", "@timestamp", - "created_at", "_document_id", - "team", "action", - "operation_type", "actor", - "request_id", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", + "operation_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" }, @@ -15387,18 +22772,31 @@ "description": "A team's privacy level was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", "fields": [ - "user_agent", - "request_id", - "org", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", "created_at", "operation_type", - "actor_id", - "org_id", - "@timestamp", - "actor", - "_document_id", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" @@ -15408,21 +22806,32 @@ "description": "A new team is created.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "oauth_application_id", + "operation_type", "team", - "org", - "actor", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "team_type" ] }, @@ -15431,21 +22840,31 @@ "description": "A user was demoted from a team maintainer to a team member.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" }, @@ -15454,19 +22873,31 @@ "description": "A team was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "team", "org_id", - "actor_id", - "actor", - "action", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", "operation_type", - "_document_id", - "programmatic_access_type", "team_type" ] }, @@ -15475,19 +22906,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "business_id", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", "actor_id", - "user", "business", - "action", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15495,19 +22937,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "operation_type", - "request_id", "actor", - "org", - "created_at", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", - "_document_id" + "operation_type", + "created_at" ] }, { @@ -15515,18 +22968,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", "@timestamp", - "action", "_document_id", - "user_agent", - "user_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business", + "user_id", + "user_agent", "operation_type", - "actor", "created_at" ] }, @@ -15535,19 +22999,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "actor", - "action", - "operation_type", - "team", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "team" ] }, { @@ -15555,19 +23031,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", "@timestamp", - "actor_id", "_document_id", - "team", - "created_at", - "org_id", "action", - "request_id", - "user_agent", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_access_security_header" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "team", + "created_at" ] }, { @@ -15575,22 +23063,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "team", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at" ] }, { @@ -15598,22 +23095,31 @@ "description": "A user was promoted from a team member to a team maintainer.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" }, @@ -15622,22 +23128,31 @@ "description": "An organization member was removed from a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", "fields": [ - "request_id", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "team", - "user_id", - "actor", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", + "user_id", "user_agent", - "_document_id", - "token_scopes", - "programmatic_access_type", + "operation_type", + "created_at", + "team", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" @@ -15645,23 +23160,33 @@ { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A", - "fields": [ - "request_id", - "org_id", - "repo", - "repo_id", - "action", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "created_at", "team", - "org", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -15669,21 +23194,32 @@ "description": "A team's name was changed.", "docs_reference_links": "N/A", "fields": [ - "name", - "user_agent", - "created_at", - "team", - "operation_type", - "actor_id", - "org", + "@timestamp", + "_document_id", "action", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "_document_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "team", + "operation_type", "team_type" ] }, @@ -15692,17 +23228,30 @@ "description": "Team synchronization with a tenant was disabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "request_id", - "org_id", "actor_id", - "operation_type", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -15711,19 +23260,30 @@ "description": "Team synchronization with a tenant was enabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ - "org_id", - "business_id", - "actor", - "created_at", - "user_agent", "@timestamp", - "operation_type", - "business", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -15732,19 +23292,30 @@ "description": "The Okta credentials for team synchronization with a tenant were changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -15752,28 +23323,37 @@ "description": "A team's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "team", - "org_id", "@timestamp", - "org", "_document_id", - "old_permission", - "request_id", - "repo", "action", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "old_permission", "operation_type", "created_at", - "user_agent", "permission", "new_repo_permission", "new_repo_base_role", "old_repo_permission", - "old_repo_base_role", - "token_scopes", - "programmatic_access_type" + "old_repo_base_role" ] }, { @@ -15781,16 +23361,30 @@ "description": "A Dependabot rule was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15800,16 +23394,30 @@ "description": "A Dependabot rule was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15819,18 +23427,31 @@ "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15840,21 +23461,33 @@ "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -15862,21 +23495,32 @@ "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -15884,21 +23528,32 @@ "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -15906,16 +23561,30 @@ "description": "A Dependabot rule's conditions, actions, or metadata changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15925,27 +23594,33 @@ "description": "A workflow job was approved.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", - "repo", - "repo_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -15954,23 +23629,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -15978,10 +23663,28 @@ "description": "A workflow run was cancelled.", "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -15992,20 +23695,9 @@ "run_number", "cancelled_at", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Canceling a workflow run" }, @@ -16014,23 +23706,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16040,10 +23740,28 @@ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -16055,19 +23773,9 @@ "conclusion", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -16078,10 +23786,28 @@ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -16090,21 +23816,10 @@ "head_branch", "head_sha", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "public_repo", - "programmatic_access_type", "actor_is_bot", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "Understanding GitHub Actions" @@ -16114,23 +23829,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -16139,22 +23866,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16162,21 +23900,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -16184,25 +23933,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16210,23 +23967,36 @@ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", "fields": [ - "repo_id", - "repo", - "org_id", - "org", - "business_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "job_name", "runner_labels", "is_hosted_runner", "environment_name", "secrets_passed", - "action", - "_document_id", "operation_type", "created_at", - "@timestamp", "runner_owner_type", "job_workflow_ref", "calling_workflow_refs", @@ -16240,24 +24010,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -16266,10 +24045,28 @@ "description": "A workflow run was re-run.", "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -16279,21 +24076,11 @@ "head_sha", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", "rerun_type", "check_run_id", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "Re-running workflows and jobs" @@ -16303,25 +24090,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.16/user.json b/src/audit-logs/data/ghes-3.16/user.json index 62161498f9ce..b8a542124b3e 100644 --- a/src/audit-logs/data/ghes-3.16/user.json +++ b/src/audit-logs/data/ghes-3.16/user.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,17 +67,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "request_id", "@timestamp", - "user_agent", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", - "user_id", + "token_scopes", "user", - "actor", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -61,18 +98,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", + "token_scopes", "user", - "request_id", - "_document_id", - "user_agent", - "actor", "user_id", - "actor_id", - "operation_type", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -80,18 +129,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "actor_id", - "operation_type", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "token_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -99,29 +160,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -129,18 +196,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -148,17 +227,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -167,19 +259,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -188,18 +292,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -207,18 +324,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -226,15 +355,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -244,26 +386,36 @@ "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -271,24 +423,34 @@ "description": "A CSV export was requested on the \"Coverage\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -296,26 +458,36 @@ "description": "A CSV export was requested on the \"Overview Dashboard\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -323,20 +495,31 @@ "description": "A CSV export was requested on the \"Risk\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -347,17 +530,30 @@ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "created_at", "operation_type" ], @@ -368,20 +564,32 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -390,19 +598,32 @@ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "limit", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -411,19 +632,31 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -432,20 +665,32 @@ "description": "The policy for fork pull request workflows was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -454,19 +699,31 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -475,20 +732,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -497,20 +765,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -521,17 +800,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -539,14 +830,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -556,25 +862,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -585,22 +900,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -612,22 +938,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -636,36 +973,64 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "owner", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "public_repo" - ] - }, + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "owner", + "created_at", + "operation_type", + "public_repo" + ] + }, { "action": "codespaces.restore", "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -675,27 +1040,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "org", "owner", "pull_request_id", "machine_type", - "user_id", - "user", "devcontainer_path", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -703,19 +1077,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -723,18 +1110,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -743,23 +1142,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -767,16 +1173,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -785,24 +1205,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -810,15 +1236,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -828,40 +1267,62 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "request_access_security_header" - ] - }, - { - "action": "copilot.cfb_seat_cancelled", - "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "copilot.cfb_seat_cancelled", + "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -869,21 +1330,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -891,21 +1361,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -915,19 +1394,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -937,21 +1425,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -961,19 +1458,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -982,19 +1490,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1003,19 +1522,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1024,19 +1554,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1045,17 +1586,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1063,19 +1617,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1084,19 +1649,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1104,19 +1680,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1125,19 +1712,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1145,19 +1743,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1166,19 +1775,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1186,19 +1806,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1207,43 +1838,62 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "created_at", - "user", - "user_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", "_document_id", - "request_access_security_header" - ] - }, - { - "action": "environment.add_protection_rule", - "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", - "fields": [ - "user_agent", - "request_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", + "operation_type" + ] + }, + { + "action": "environment.add_protection_rule", + "description": "A GitHub Actions deployment protection rule was created via the API.", + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1252,22 +1902,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1275,28 +1935,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1305,27 +1971,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -1334,25 +2008,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1361,26 +2043,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1389,21 +2078,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1412,23 +2113,33 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "public_repo", - "request_access_security_header" - ], + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "public_repo" + ], "docs_reference_titles": "Managing environments for deployment" }, { @@ -1436,25 +2147,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1463,22 +2183,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1487,21 +2219,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -1512,21 +2254,32 @@ "description": "A gist was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "gist_id", - "@timestamp", "created_at", "operation_type", - "user_agent", - "actor", - "actor_id", - "visibility", - "action", - "_document_id", - "token_scopes", - "programmatic_access_type" + "visibility" ] }, { @@ -1534,20 +2287,32 @@ "description": "A gist was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "gist_id", - "visibility", - "created_at", + "@timestamp", "_document_id", - "user", - "request_id", - "operation_type", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "@timestamp", - "programmatic_access_type" + "gist_id", + "visibility", + "created_at", + "operation_type" ] }, { @@ -1555,21 +2320,32 @@ "description": "The visibility of a gist was updated.", "docs_reference_links": "N/A", "fields": [ - "action", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", - "user", - "gist_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "visibility", - "user_id", - "created_at", - "_document_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "gist_id", + "visibility", + "created_at" ] }, { @@ -1577,22 +2353,33 @@ "description": "An SSH key was added to a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -1601,23 +2388,34 @@ "description": "An SSH key was removed from a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", "explanation", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -1626,23 +2424,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1650,18 +2457,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1672,20 +2489,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1695,18 +2522,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "created_at", - "user_id", "@timestamp", - "user", - "operation_type", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -1714,18 +2553,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "created_at", - "_document_id", + "user_id", "user_agent", - "@timestamp", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -1733,25 +2584,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -1759,25 +2620,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -1785,26 +2655,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -1813,25 +2692,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -1839,26 +2727,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", - "repo", - "operation_type", - "action", - "_document_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", + "operation_type", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -1866,21 +2763,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -1889,19 +2797,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -1909,21 +2830,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -1932,19 +2864,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -1955,20 +2901,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -1978,24 +2936,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2006,23 +2975,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2033,20 +3014,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2056,19 +3050,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -2077,20 +3085,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -2100,20 +3121,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -2122,20 +3156,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -2144,20 +3191,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -2165,19 +3224,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2186,19 +3258,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2207,17 +3292,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2230,21 +3328,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -2258,17 +3369,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ - "actor", - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2280,18 +3404,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2299,21 +3435,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -2321,21 +3470,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -2343,22 +3505,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -2366,19 +3541,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -2389,21 +3577,36 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "actor", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", "marketplace_listing", "has_free_trial", - "user_agent", - "request_id", - "actor_id", "yearly_price_in_cents", "description", "bullets", "monthly_price_in_cents", - "marketplace_listing_plan", - "_document_id" + "marketplace_listing_plan" ] }, { @@ -2411,22 +3614,37 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "marketplace_listing_plan", "marketplace_listing", "description", "bullets", "has_free_trial", "created_at", - "actor_id", "operation_type", - "_document_id", - "action", - "user_agent", - "request_id", - "actor", "monthly_price_in_cents", - "yearly_price_in_cents", - "@timestamp" + "yearly_price_in_cents" ] }, { @@ -2434,21 +3652,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor", - "marketplace_listing_plan", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "marketplace_listing_plan", "description", "yearly_price_in_cents", - "@timestamp", "created_at", - "actor_id", "bullets", "has_free_trial", "marketplace_listing", - "user_agent", "monthly_price_in_cents", - "action", "operation_type" ] }, @@ -2457,21 +3690,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "monthly_price_in_cents", - "marketplace_listing", + "@timestamp", "_document_id", "action", - "description", - "bullets", - "yearly_price_in_cents", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "monthly_price_in_cents", + "marketplace_listing", + "description", + "bullets", + "yearly_price_in_cents", "has_free_trial", "marketplace_listing_plan", - "user_agent", - "@timestamp", "operation_type", - "actor", "created_at" ] }, @@ -2480,22 +3728,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -2503,22 +3764,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2526,19 +3800,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2546,21 +3832,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2570,16 +3865,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2589,18 +3897,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2610,14 +3931,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -2625,19 +3962,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -2645,42 +3993,62 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "org", - "created_at", - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", - "request_access_security_header" - ] - }, - { - "action": "migration.create", - "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A", - "fields": [ - "repo", - "org_id", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", + "operation_type" + ] + }, + { + "action": "migration.create", + "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "user_agent", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -2688,20 +4056,30 @@ "description": "An OAuth access token was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", "fields": [ - "_document_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "user", - "user_id", - "created_at", + "_document_id", "action", + "actor", "actor_id", - "request_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" @@ -2712,19 +4090,30 @@ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", "fields": [ "@timestamp", - "user_agent", - "action", - "operation_type", "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_id", + "user_agent", + "operation_type", + "created_at", "explanation", - "hashed_token", - "actor_id", - "token_scopes", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" @@ -2734,19 +4123,30 @@ "description": "An OAuth access token was regenerated.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "_document_id", - "created_at", "@timestamp", - "operation_type", + "_document_id", "action", - "user_agent", - "request_id", "actor", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "oauth_application_name" ] }, @@ -2755,18 +4155,30 @@ "description": "An OAuth access token was updated.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -2774,20 +4186,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2796,20 +4220,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2818,20 +4254,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2840,20 +4288,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2862,19 +4322,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2883,20 +4356,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2905,20 +4390,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2927,19 +4424,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2948,24 +4458,31 @@ "description": "An authorization for an OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ - "operation_type", - "user_agent", - "user_id", - "actor", - "org_id", + "@timestamp", "_document_id", - "request_id", "action", - "@timestamp", - "created_at", + "actor", "actor_id", - "user", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_is_bot", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -2975,20 +4492,31 @@ "description": "An authorization for an OAuth application was deleted.", "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", "fields": [ - "user_agent", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "actor", "created_at", "explanation", - "user", - "user_id", - "org_id", - "action", - "actor_id", - "token_scopes", "actor_is_bot", "oauth_application_name" ], @@ -2999,20 +4527,31 @@ "description": "An authorization for an OAuth application was updated.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", - "actor_id", "user_agent", - "@timestamp", "operation_type", - "action", - "user", "created_at", - "_document_id", "actor_is_bot", - "request_access_security_header", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -3022,21 +4561,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -3045,24 +4594,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", - "org", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3070,20 +4629,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -3091,22 +4660,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -3114,20 +4691,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -3135,22 +4722,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -3158,21 +4753,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3180,26 +4784,35 @@ "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -3208,26 +4821,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3235,28 +4856,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3264,26 +4893,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3291,20 +4928,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -3313,16 +4961,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -3333,18 +4994,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -3353,18 +5027,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -3373,18 +5059,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -3393,18 +5092,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -3414,20 +5125,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -3435,17 +5157,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -3455,20 +5190,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -3477,20 +5223,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", - "owner_type", - "domain", - "state", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", + "owner_type", + "domain", + "state", + "created_at", + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -3499,17 +5259,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3520,20 +5295,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -3542,19 +5331,31 @@ "description": "A new passkey was added.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3562,19 +5363,31 @@ "description": "A new passkey was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3582,18 +5395,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3601,16 +5426,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3618,18 +5457,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -3637,18 +5488,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3659,18 +5523,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3681,17 +5558,30 @@ "description": "Triggered when you create a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3701,19 +5591,31 @@ "description": "Triggered when you regenerate a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3721,12 +5623,29 @@ "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", "fields": [ - "user_programmatic_access_name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", "operation_type" ], @@ -3737,20 +5656,32 @@ "description": "Triggered when you delete a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "explanation", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3758,17 +5689,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -3779,18 +5723,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -3802,17 +5759,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -3824,17 +5794,30 @@ "description": "A fine-grained personal access token was updated.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3845,15 +5828,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3863,35 +5861,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type" - ] - }, - { - "action": "premium_runner.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "premium_runner.update", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3901,17 +5925,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -3921,17 +5956,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -3941,17 +5987,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -3961,17 +6018,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -3981,17 +6049,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -4001,17 +6082,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4019,20 +6113,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -4042,25 +6147,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -4068,20 +6185,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4089,25 +6218,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4115,17 +6256,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -4133,17 +6287,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -4151,18 +6318,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -4171,18 +6350,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -4191,19 +6382,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -4211,17 +6413,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -4233,79 +6448,125 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" - ] - }, - { - "action": "project.unlink", - "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A", - "fields": [ + "org_id", + "programmatic_access_type", "repo", "repo_id", - "operation_type", - "actor", - "action", - "created_at", - "actor_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "created_at", + "old_name", + "operation_type" ] }, { - "action": "project.update_org_permission", - "description": "The project's base-level permission for all organization members was changed or removed.", + "action": "project.unlink", + "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", - "org_id", - "user_agent" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { - "action": "project.update_team_permission", - "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", + "action": "project.update_org_permission", + "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "team", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "project.update_team_permission", + "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -4313,20 +6574,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4334,18 +6605,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -4354,18 +6637,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -4374,16 +6669,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -4395,21 +6703,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -4417,18 +6737,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4439,49 +6772,71 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", - "actor_id", - "operation_type", - "created_at", + "@timestamp", "_document_id", - "key", - "fingerprint", - "actor", "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" - }, - { - "action": "public_key.delete", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", + "operation_type", + "created_at", + "key", + "fingerprint", + "title" + ], + "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + }, + { + "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -4490,20 +6845,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4512,21 +6881,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -4536,22 +6918,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4560,25 +6954,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4587,23 +6991,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", "key", "fingerprint", - "actor_id", - "actor", "title", - "user_agent", - "user_id", - "request_id", - "read_only", - "token_scopes", - "programmatic_access_type" + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4612,22 +7027,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -4636,21 +7061,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -4659,25 +7093,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -4686,23 +7127,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -4711,24 +7160,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -4737,23 +7193,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -4763,22 +7227,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -4787,19 +7260,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -4808,24 +7294,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -4834,23 +7330,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4861,34 +7366,60 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "actor", - "actor_id", - "repo_id", + "@timestamp", "_document_id", "action", - "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.config.disable_contributors_only", - "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "repo", - "@timestamp", - "request_id", "actor", - "_document_id", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + }, + { + "action": "repo.config.disable_contributors_only", + "description": "The interaction limit for prior contributors only was disabled in a repository.", + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -4899,16 +7430,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -4918,17 +7462,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -4938,19 +7495,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -4959,17 +7527,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -4978,26 +7559,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -5006,30 +7593,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -5039,20 +7631,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5061,25 +7664,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5088,23 +7699,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -5112,25 +7734,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -5140,23 +7771,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -5164,21 +7805,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -5186,21 +7837,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -5208,22 +7869,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -5231,21 +7901,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -5253,43 +7933,63 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ] - }, - { - "action": "repo.pages_public", - "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "visibility", + "programmatic_access_type", "repo", "repo_id", - "org", - "org_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", + "created_at" + ] + }, + { + "action": "repo.pages_public", + "description": "A GitHub Pages site visibility was changed to public.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -5297,18 +7997,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5316,22 +8030,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5339,21 +8063,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -5361,18 +8095,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -5381,22 +8127,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5405,24 +8160,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5431,50 +8194,65 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "key", - "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", - "public_repo", - "request_access_security_header" - ] - }, - { - "action": "repo.remove_member", - "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", - "fields": [ - "request_id", - "user", - "business", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "key", + "integration", "operation_type", + "created_at", + "public_repo" + ] + }, + { + "action": "repo.remove_member", + "description": "A collaborator was removed from a repository.", + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ "@timestamp", "_document_id", - "visibility", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -5483,21 +8261,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -5506,25 +8293,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -5532,22 +8325,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -5556,19 +8359,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -5576,23 +8390,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -5602,20 +8425,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -5626,21 +8460,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -5649,22 +8494,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -5673,21 +8528,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -5696,22 +8562,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -5722,16 +8598,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -5740,22 +8627,31 @@ "description": "Temporary access was enabled for a repository.", "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing user-owned repositories in your enterprise" }, @@ -5765,22 +8661,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -5789,23 +8696,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -5815,19 +8732,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -5835,21 +8762,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -5858,24 +8795,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -5883,25 +8829,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5910,24 +8863,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -5936,25 +8899,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5963,22 +8934,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -5987,26 +8967,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -6014,31 +9002,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -6047,21 +9042,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -6069,21 +9074,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -6091,21 +9106,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -6113,20 +9139,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -6134,21 +9172,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -6156,19 +9205,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -6176,31 +9238,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -6209,19 +9279,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -6229,8 +9310,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -6239,23 +9319,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -6280,18 +9369,30 @@ "description": "A security key was registered for an account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "created_at", - "user_id", - "action", - "operation_type", - "request_id", "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -6299,18 +9400,30 @@ "description": "A security key was removed from an account.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "operation_type", - "_document_id", - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6318,37 +9431,63 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type" - ] - }, - { - "action": "sponsors.custom_amount_settings_change", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sponsors_listing_id", + "created_at", + "operation_type" + ] + }, + { + "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -6357,16 +9496,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6377,15 +9529,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -6395,15 +9560,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -6412,17 +9592,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -6431,17 +9624,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -6450,16 +9657,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -6469,14 +9689,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -6486,17 +9721,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -6505,37 +9753,63 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", - "user_agent", - "actor" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6544,15 +9818,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -6562,16 +9850,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6579,15 +9880,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -6598,16 +9912,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -6617,17 +9944,30 @@ "description": "Triggered when you send an email update to your sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", "fields": [ - "request_id", - "actor", - "action", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" }, @@ -6636,17 +9976,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -6657,17 +10010,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -6678,18 +10044,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6699,16 +10076,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6718,17 +10108,30 @@ "description": "You join the waitlist to join GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "actor_id", - "action", "operation_type", - "created_at", - "user", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -6737,16 +10140,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6756,23 +10172,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6780,23 +10206,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6804,23 +10240,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6828,23 +10274,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6852,15 +10308,30 @@ "description": "Triggered when you accept a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6869,15 +10340,30 @@ "description": "Triggered when you cancel a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6886,32 +10372,62 @@ "description": "Triggered when you create a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "action", - "operation_type", "@timestamp", - "created_at", - "_document_id" - ], - "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" - }, - { - "action": "successor_invitation.decline", - "description": "Triggered when you decline a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", - "fields": [ - "user_agent", - "request_id", + "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" + }, + { + "action": "successor_invitation.decline", + "description": "Triggered when you decline a succession invitation.", + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ "@timestamp", - "created_at", - "_document_id" + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6920,15 +10436,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6936,15 +10467,30 @@ "description": "Triggered when you revoke a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6953,17 +10499,30 @@ "description": "A new trusted device was added.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6971,17 +10530,30 @@ "description": "A trusted device was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6989,14 +10561,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "action", - "request_id", - "user_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -7005,15 +10592,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "created_at", - "user_id", - "operation_type", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action" + "created_at", + "operation_type" ] }, { @@ -7021,13 +10623,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "created_at", - "user_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7035,17 +10654,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "operation_type", - "action", - "_document_id" + "created_at", + "operation_type" ] }, { @@ -7053,17 +10685,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor", - "action", "@timestamp", - "user_agent", - "operation_type", - "user", - "created_at", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "_document_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7071,16 +10716,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7088,15 +10747,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_id", - "action", "@timestamp", - "created_at", - "user_agent", - "user", "_document_id", - "request_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7104,18 +10778,30 @@ "description": "A secondary authentication factor was added to a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -7124,18 +10810,30 @@ "description": "Two-factor authentication was disabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", "fields": [ - "actor", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor_id", + "user_agent", "created_at", - "operation_type", - "request_id", - "@timestamp", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Disabling two-factor authentication for your personal account" }, @@ -7144,18 +10842,30 @@ "description": "Two-factor authentication was enabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ - "actor", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Configuring two-factor authentication" }, @@ -7164,15 +10874,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user", - "user_id", - "action", "@timestamp", - "request_id", "_document_id", - "user_agent" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7180,16 +10905,29 @@ "description": "Two factor recovery codes were regenerated for a user account.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", + "operation_type", "created_at" ] }, @@ -7198,18 +10936,30 @@ "description": "A secondary authentication factor was removed from a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -7218,15 +10968,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "created_at", - "_document_id", - "action", - "@timestamp" + "operation_type", + "created_at" ] }, { @@ -7235,16 +11000,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", "_document_id", - "user", - "user_id", - "operation_type", - "user_agent", "action", - "request_id", "actor", - "actor_id" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7252,19 +11030,31 @@ "description": "An email address was added to a user account.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", "operation_type", - "_document_id", - "actor_id", - "actor", "email", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding an email address to your GitHub account" }, @@ -7273,18 +11063,30 @@ "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "created_at", - "user", "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -7292,15 +11094,28 @@ "description": "Audit log entries were exported.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "action", - "request_id", - "actor", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", "created_at" ] @@ -7310,20 +11125,31 @@ "description": "A user was blocked by another user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_id", - "_document_id", "actor_id", - "@timestamp", - "user_agent", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -7331,18 +11157,30 @@ "description": "A user changed their password.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "actor_id", - "operation_type", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "created_at", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7350,18 +11188,30 @@ "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -7370,17 +11220,30 @@ "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -7389,81 +11252,128 @@ "description": "A new user account was created.", "docs_reference_links": "N/A", "fields": [ - "email", - "user_id", - "operation_type", "@timestamp", - "request_id", - "user", - "created_at", "_document_id", - "user_agent", - "actor", - "actor_id", "action", - "programmatic_access_type" - ] - }, - { - "action": "user.create_integration_secret", - "description": "A user secret for Codespaces was created.", - "docs_reference_links": "N/A", - "fields": [ "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "key", - "visibility", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", - "created_at", + "user_agent", + "email", "operation_type", - "request_access_security_header" + "created_at" ] }, { - "action": "user.creation_rate_limit_exceeded", - "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", + "action": "user.create_integration_secret", + "description": "A user secret for Codespaces was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "user_agent", + "@timestamp", "_document_id", - "operation_type", - "oauth_application_id", "action", "actor", "actor_id", - "request_id", - "user_id", - "@timestamp", - "token_scopes", - "programmatic_access_type" - ] + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "visibility", + "integration", + "created_at", + "operation_type" + ] }, { - "action": "user.delete", - "description": "A user account was destroyed by an asynchronous job.", + "action": "user.creation_rate_limit_exceeded", + "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "request_id", - "user_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" + ] + }, + { + "action": "user.delete", + "description": "A user account was destroyed by an asynchronous job.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", "_document_id", - "request_access_security_header" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7472,19 +11382,30 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "oauth_application_id", + "_document_id", "action", - "user", - "created_at", - "user_agent", - "request_id", "actor", "actor_id", - "operation_type", - "_document_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", + "operation_type" ] }, { @@ -7492,18 +11413,30 @@ "description": "A user deleted his or her account, triggering user.async_delete.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", - "created_at", - "user_agent", "user_id", - "operation_type", - "actor_id", - "action", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7511,18 +11444,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "user_agent", "user_id", - "actor_id", - "action", - "operation_type", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7530,18 +11475,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "operation_type", - "created_at", - "_document_id", - "@timestamp", - "user", - "actor_id", - "action", - "request_access_security_header" + "created_at" ] }, { @@ -7550,17 +11507,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user", "_document_id", "action", - "operation_type", - "user_agent", - "created_at", - "request_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7568,17 +11537,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7586,17 +11568,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7604,17 +11599,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7622,21 +11630,31 @@ "description": "An enterprise managed user claimed an email address.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7644,21 +11662,31 @@ "description": "N/A", "docs_reference_links": "An enterprise managed user unclaimed an email address.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." }, @@ -7667,17 +11695,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7685,17 +11726,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7703,17 +11757,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7721,18 +11788,30 @@ "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "action", - "operation_type", - "request_id", - "created_at", - "_document_id", "@timestamp", - "user", - "org_id", + "_document_id", + "action", "actor", "actor_id", - "user_agent" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7740,17 +11819,31 @@ "description": "A user requested a password reset.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", "fields": [ - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "email", - "created_at", - "user_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" }, @@ -7759,17 +11852,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "created_at", - "user_agent", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor", - "operation_type", - "request_id" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7777,18 +11883,30 @@ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -7797,19 +11915,31 @@ "description": "A user signed in.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "actor_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", + "user_agent", "operation_type", - "_document_id", - "request_id", "created_at", - "actor", - "passkey_nickname", - "request_access_security_header" + "passkey_nickname" ] }, { @@ -7817,18 +11947,30 @@ "description": "A user signed out.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7836,18 +11978,30 @@ "description": "A user signed in from a new device.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7855,21 +12009,31 @@ "description": "An ordinary user account was promoted to a site administrator.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", + "user_id", "user_agent", + "created_at", "oauth_application_id", - "request_id", - "operation_type", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7877,16 +12041,29 @@ "description": "A user's account was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user", - "action", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "actor", "operation_type" ] }, @@ -7895,20 +12072,31 @@ "description": "An email address was removed from a user account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "actor", - "actor_id", "created_at", - "email", - "token_scopes", - "programmatic_access_type" + "email" ] }, { @@ -7916,20 +12104,32 @@ "description": "A user secret for Codespaces was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "key", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "key", + "integration", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7937,20 +12137,31 @@ "description": "A username was changed.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "request_id", - "actor_id", - "old_login", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "operation_type", "user_agent", - "token_scopes", - "programmatic_access_type" + "old_login", + "created_at", + "operation_type" ] }, { @@ -7958,18 +12169,30 @@ "description": "A user reset their account password.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "@timestamp", - "_document_id", - "actor", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7977,16 +12200,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_id", - "action", "@timestamp", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -7997,16 +12233,28 @@ "fields": [ "@timestamp", "_document_id", - "request_id", - "user_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor_id", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -8015,18 +12263,30 @@ "description": "A user signed in from an unrecognized device.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "created_at", - "actor", - "actor_id", - "@timestamp", - "request_access_security_header" + "created_at" ] }, { @@ -8034,18 +12294,30 @@ "description": "A user signed in from an unrecognized device and location.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "created_at", - "_document_id", - "request_id", - "action", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8053,22 +12325,33 @@ "description": "Triggered when you clear the status on your profile.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "message", - "user", - "actor_id", "created_at", - "request_id", "limited_availability", - "action", "emoji", - "operation_type", - "user_agent", - "@timestamp", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -8076,23 +12359,33 @@ "description": "Triggered when you set or change the status on your profile.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", "fields": [ - "limited_availability", - "user", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "message", - "user_id", - "created_at", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "limited_availability", + "message", + "created_at", "emoji", - "org", - "actor", - "operation_type", - "token_scopes", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Personalize your profile" }, @@ -8101,21 +12394,31 @@ "description": "A user account was suspended.", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", - "operation_type", - "actor_id", - "user", - "user_agent", - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", - "user_id", + "_document_id", "action", - "token_scopes", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -8123,18 +12426,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", - "actor_id", "@timestamp", - "operation_type", "_document_id", - "user_agent", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8142,18 +12457,30 @@ "description": "A 2FA challenge issued for a user account failed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "_document_id", - "user_agent", - "user", - "actor_id", - "actor", - "user_id", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8163,16 +12490,28 @@ "fields": [ "@timestamp", "_document_id", - "user_id", - "operation_type", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "actor", + "user_id", "user_agent", - "request_id", - "action", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8180,18 +12519,30 @@ "description": "A user used their 2FA recovery codes.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", "user_agent", - "request_id", - "user", - "action", - "actor", - "actor_id", - "created_at", - "@timestamp", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8199,18 +12550,30 @@ "description": "A user downloaded 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8218,17 +12581,30 @@ "description": "A user printed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", - "user_agent", - "request_id", - "user_id", - "created_at", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8236,18 +12612,30 @@ "description": "A user viewed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", "created_at", - "user", - "operation_type", - "@timestamp", - "request_id", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -8255,17 +12643,30 @@ "description": "A user was prompted for a two-factor authentication code.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", "fields": [ - "user", - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "actor" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" }, @@ -8274,19 +12675,31 @@ "description": "A user was unblocked by another user.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "actor", - "@timestamp", - "user_agent", - "user_id", - "user", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -8294,21 +12707,31 @@ "description": "A user account was unsuspended.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", - "user", "action", - "user_agent", "actor", - "oauth_application_id", - "operation_type", "actor_id", - "created_at", - "@timestamp", - "user_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -8316,21 +12739,33 @@ "description": "A user secret for Codespaces was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8338,46 +12773,64 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", + "operation_type" + ] + }, + { + "action": "workflows.approve_workflow_job", + "description": "A workflow job was approved.", + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" - ] - }, - { - "action": "workflows.approve_workflow_job", - "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", - "fields": [ "user_agent", - "request_id", - "actor", - "actor_id", "workflow_run_id", "run_number", - "user", - "user_id", - "repo", - "repo_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -8386,23 +12839,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8410,23 +12873,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8436,23 +12907,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -8461,22 +12944,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8484,21 +12978,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -8506,25 +13011,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8532,24 +13045,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -8558,25 +13080,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.17/enterprise.json b/src/audit-logs/data/ghes-3.17/enterprise.json index dd8c56641d70..7b3d5fe69cc2 100644 --- a/src/audit-logs/data/ghes-3.17/enterprise.json +++ b/src/audit-logs/data/ghes-3.17/enterprise.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,17 +67,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "request_id", "@timestamp", - "user_agent", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", - "user_id", + "token_scopes", "user", - "actor", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -61,18 +98,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", + "token_scopes", "user", - "request_id", - "_document_id", - "user_agent", - "actor", "user_id", - "actor_id", - "operation_type", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -80,18 +129,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "actor_id", - "operation_type", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "token_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -99,29 +160,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -129,31 +196,34 @@ "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests", "fields": [ - "user_agent", - "request_id", - "request_method", - "query_string", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", - "request_body", - "status_code", - "url_path", "business", "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "request_method", + "query_string", + "request_body", + "status_code", + "url_path", + "public_repo", "created_at", "operation_type", "route", @@ -167,18 +237,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -186,20 +268,32 @@ "description": "A manual check of the endpoint configured for audit log streaming was performed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "audit_log_stream_result", - "business_id", "business", - "action", - "_document_id", - "@timestamp", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_result", "created_at", "operation_type", - "audit_log_stream_sink_details", - "request_access_security_header" + "audit_log_stream_sink_details" ] }, { @@ -207,18 +301,31 @@ "description": "An endpoint was added for audit log streaming.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "business_id", "business", - "audit_log_stream_sink", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_sink", + "created_at", + "operation_type", "audit_log_stream_id" ] }, @@ -227,15 +334,28 @@ "description": "An audit log streaming endpoint was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "business_id", "business", - "action", - "_document_id", - "@timestamp", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "audit_log_stream_id", @@ -247,17 +367,30 @@ "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "audit_log_stream_enabled", - "business_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_enabled", "audit_log_stream_sink", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "new_s3_bucket", @@ -280,17 +413,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -299,19 +445,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -320,18 +478,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -339,18 +510,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -358,15 +541,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -376,22 +572,31 @@ "description": "An enterprise owner was added to an enterprise.", "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", "fields": [ - "name", - "business", - "user", - "user_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "request_id", + "business", "business_id", - "_document_id", - "user_agent", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "operation_type" ], "docs_reference_titles": "Inviting people to manage your enterprise" }, @@ -400,22 +605,32 @@ "description": "An organization was added to an enterprise.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "operation_type", "name", "created_at", - "request_id", - "_document_id", - "business", - "organization_upgrade", - "request_access_security_header" + "organization_upgrade" ] }, { @@ -423,20 +638,30 @@ "description": "GitHub Advanced Security was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ - "actor", - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -445,17 +670,28 @@ "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -466,21 +702,31 @@ "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -489,17 +735,28 @@ "description": "GitHub Advanced Security was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -510,17 +767,28 @@ "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -531,21 +799,31 @@ "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -554,20 +832,32 @@ "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "new_policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "new_policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -576,20 +866,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -597,17 +899,28 @@ "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -619,21 +932,31 @@ "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -642,18 +965,31 @@ "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -662,17 +998,30 @@ "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", "fields": [ - "name", - "operation_type", - "business_id", - "user_agent", - "actor_id", - "request_id", - "actor", + "@timestamp", "_document_id", - "business", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -682,19 +1031,32 @@ "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", "business_id", - "action", - "_document_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "business", "visibility", "created_at", - "actor", - "operation_type", - "@timestamp" + "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -703,21 +1065,33 @@ "description": "The policy for Code scanning autofix was updated for an enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -725,21 +1099,33 @@ "description": "The policy for Code scanning autofix third party tools was updated for an enterprise.", "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/getting-started/github-security-features#available-with-github-code-security" }, @@ -748,18 +1134,30 @@ "description": "The policy for Code Security enablement was updated for an enterprise.", "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -771,19 +1169,31 @@ "description": "An enterprise was created.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", "_document_id", "action", - "@timestamp", - "request_id", - "name", + "actor", + "actor_id", "business", "business_id", - "operation_type", - "actor", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "name", + "operation_type", + "created_at" ] }, { @@ -791,17 +1201,28 @@ "description": "Dependabot alerts were disabled for new repositories in your enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -811,17 +1232,28 @@ "description": "Dependabot alerts were enabled for new repositories in your enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -831,17 +1263,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -851,18 +1296,30 @@ "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -870,17 +1327,28 @@ "description": "Display of IP addresses within audit log events for the enterprise was disabled.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -891,18 +1359,31 @@ "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.", "docs_reference_links": "N/A", "fields": [ - "action", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "business_id", - "actor_id", - "name", - "_document_id", - "request_id" + "name" ] }, { @@ -910,15 +1391,28 @@ "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -928,17 +1422,28 @@ "description": "Display of IP addresses within audit log events for the enterprise was enabled.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -949,18 +1454,31 @@ "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "operation_type", - "created_at", + "actor_id", "business", "business_id", - "name", - "_document_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "name" ] }, { @@ -968,20 +1486,31 @@ "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", "actor_id", - "@timestamp", - "request_id", "business", - "name", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "business_id", - "_document_id" + "created_at", + "name", + "operation_type" ] }, { @@ -989,20 +1518,31 @@ "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1010,20 +1550,31 @@ "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "name", - "actor", - "operation_type", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "business", - "actor_id", - "created_at", - "action", + "user_id", "user_agent", - "request_id", - "user_id" + "name", + "operation_type", + "created_at" ] }, { @@ -1031,20 +1582,31 @@ "description": "An enterprise owner was removed from an enterprise.", "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", - "user_agent", + "actor_id", "business", "business_id", - "@timestamp", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "name", - "actor_id", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", - "user" + "user_agent", + "operation_type", + "created_at", + "name" ], "docs_reference_titles": "Inviting people to manage your enterprise" }, @@ -1053,20 +1615,31 @@ "description": "An organization was removed from an enterprise.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "business", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "business_id", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "name", - "org" + "name" ] }, { @@ -1074,18 +1647,31 @@ "description": "The slug for the enterprise URL was renamed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "name", - "business_id", - "user_agent", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", - "@timestamp", - "created_at", + "actor_id", "business", - "_document_id" + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ] }, { @@ -1093,20 +1679,31 @@ "description": "The SAML single sign-on session for a member in an enterprise was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", - "user_agent", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "actor", - "_document_id", - "actor_id", "name", - "@timestamp", - "user_id", - "action", - "created_at", - "business" + "created_at" ] }, { @@ -1114,17 +1711,28 @@ "description": "Automatic partner validation checks have been disabled at the business level", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1135,17 +1743,28 @@ "description": "Automatic partner validation checks have been enabled at the business level", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1156,20 +1775,30 @@ "description": "An enterprise-level custom pattern was created for secret scanning.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -1178,17 +1807,28 @@ "description": "An enterprise-level custom pattern was removed from secret scanning.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1198,20 +1838,30 @@ "description": "An enterprise-level custom pattern was published for secret scanning.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1219,17 +1869,28 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1240,20 +1901,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -1262,17 +1933,28 @@ "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1282,17 +1964,28 @@ "description": "Secret scanning was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1303,17 +1996,28 @@ "description": "Secret scanning was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1324,17 +2028,28 @@ "description": "Secret scanning was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1345,17 +2060,28 @@ "description": "Secret scanning was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1366,17 +2092,28 @@ "description": "Secret scanning for non-provider patterns was disabled at the enterprise level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1388,17 +2125,28 @@ "description": "Secret scanning for non-provider patterns was enabled at the enterprise level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1410,17 +2158,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1431,17 +2190,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1452,17 +2222,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1473,17 +2254,28 @@ "description": "Push protection for secret scanning was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1494,17 +2286,28 @@ "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -1515,17 +2318,28 @@ "description": "Push protection for secret scanning was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1536,17 +2350,28 @@ "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1557,20 +2382,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1578,26 +2415,36 @@ "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1605,24 +2452,34 @@ "description": "A CSV export was requested on the \"Coverage\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1630,26 +2487,36 @@ "description": "A CSV export was requested on the \"Overview Dashboard\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1657,20 +2524,31 @@ "description": "A CSV export was requested on the \"Risk\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1681,17 +2559,30 @@ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "created_at", "operation_type" ], @@ -1702,20 +2593,32 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1724,40 +2627,65 @@ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "limit", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { - "action": "business.set_default_workflow_permissions", - "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", - "fields": [ - "actor", - "actor_id", - "user_agent", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", + "limit", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" + }, + { + "action": "business.set_default_workflow_permissions", + "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1766,20 +2694,32 @@ "description": "The policy for fork pull request workflows was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1788,19 +2728,31 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1809,20 +2761,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "issuer", - "name", - "user_agent", - "action", "@timestamp", "_document_id", + "action", "actor", + "actor_id", "business", "business_id", - "actor_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "issuer", + "name", + "created_at", + "operation_type" ] }, { @@ -1830,18 +2794,31 @@ "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "updated_github_owned_allowed", "updated_verified_allowed", "updated_patterns", @@ -1856,20 +2833,33 @@ "description": "The base repository permission setting was updated for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", "fields": [ - "business_id", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "permission", - "action", "created_at", - "@timestamp", - "request_id", "name", - "_document_id", - "old_permission", - "business" + "old_permission" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -1878,19 +2868,32 @@ "description": "The repository creation setting was updated for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation", "fields": [ - "created_at", + "@timestamp", "_document_id", - "request_id", - "name", - "business_id", + "action", "actor", "actor_id", - "@timestamp", - "operation_type", - "permission", - "action", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "name", + "operation_type", + "permission", "visibility" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -1900,19 +2903,32 @@ "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories", "fields": [ - "business_id", - "created_at", - "action", - "operation_type", "@timestamp", - "request_id", - "permission", + "_document_id", + "action", "actor", "actor_id", - "name", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "business" + "created_at", + "operation_type", + "permission", + "name" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -1921,20 +2937,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -1943,20 +2970,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -1967,17 +3005,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -1985,15 +3035,31 @@ "description": "Existing code scanning alerts appeared in a branch.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2003,15 +3069,31 @@ "description": "Code scanning alerts were fixed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2021,15 +3103,31 @@ "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_numbers", "commit_oid", - "ref", - "request_id", - "org_id", - "org", - "business_id", - "business" + "ref" ], "docs_reference_titles": "About code scanning" }, @@ -2038,15 +3136,29 @@ "description": "Code scanning alerts were manually dismissed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers", "dismissal_approver_id" ], @@ -2057,19 +3169,31 @@ "description": "Dismissal of code scanning alerts was approved.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2080,19 +3204,31 @@ "description": "Dismissal of code scanning alerts was denied.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2103,19 +3239,31 @@ "description": "Dismissal of code scanning alerts was requested.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2126,13 +3274,31 @@ "description": "Code scanning alerts were seen for the first time.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "commit_oid", - "ref", - "request_id", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", + "commit_oid", + "ref", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2142,15 +3308,31 @@ "description": "Code scanning alerts that were previously fixed reappeared.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2160,15 +3342,29 @@ "description": "Code scanning alerts that were previously dismissed were reopened.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2178,14 +3374,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2195,25 +3406,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -2224,22 +3444,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -2251,22 +3482,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -2275,15 +3517,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -2294,17 +3551,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2314,27 +3584,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", "org", - "owner", - "pull_request_id", - "machine_type", - "user_id", - "user", - "devcontainer_path", - "repo", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "owner", + "pull_request_id", + "machine_type", + "devcontainer_path", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2342,19 +3621,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -2362,18 +3654,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -2382,23 +3686,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2406,16 +3717,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -2424,24 +3749,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2449,15 +3780,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -2467,20 +3811,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2488,19 +3842,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -2508,21 +3874,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -2530,21 +3905,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "owner_type", "actor_id", - "user_id", - "owner", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "_document_id", - "@timestamp", + "user_id", + "user_agent", + "owner_type", + "owner", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -2552,21 +3938,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "owner_type", "actor_id", - "user_id", - "owner", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "_document_id", - "@timestamp", + "user_id", + "user_agent", + "owner_type", + "owner", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -2574,21 +3971,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2598,19 +4004,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -2620,21 +4035,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2644,18 +4068,31 @@ "description": "A new custom property definition was created.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -2668,18 +4105,31 @@ "description": "A custom property definition was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -2693,14 +4143,29 @@ "description": "A custom property definition was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "value_type", @@ -2713,8 +4178,7 @@ "old_default_value", "old_value_type", "old_values_editable_by", - "values_editable_by", - "request_access_security_header" + "values_editable_by" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2723,27 +4187,35 @@ "description": "A repository's custom property value was manually set for the first time.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2752,19 +4224,31 @@ "description": "A repository's custom property value was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2773,16 +4257,29 @@ "description": "A repository's custom property value was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "definition_id" @@ -2794,19 +4291,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -2815,19 +4323,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -2836,19 +4355,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -2857,19 +4387,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -2878,17 +4419,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2896,19 +4450,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -2917,19 +4482,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2937,40 +4513,62 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependabot_security_updates_new_repos.enable", - "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + }, + { + "action": "dependabot_security_updates_new_repos.enable", + "description": "Dependabot security updates were enabled for all new repositories.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2978,19 +4576,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -2999,19 +4608,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3019,19 +4639,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -3040,20 +4671,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3061,21 +4702,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "team", - "created_at", - "user_id", "@timestamp", - "number", - "org", - "title", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", "user_agent", - "operation_type", - "_document_id" + "team", + "created_at", + "number", + "title", + "operation_type" ] }, { @@ -3083,18 +4736,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user_id", - "actor", "number", - "user", - "created_at", - "request_id", - "_document_id" + "created_at" ] }, { @@ -3102,18 +4768,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "action", - "_document_id", - "request_id", - "org", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org_id", "user_agent", - "actor", + "operation_type", "number", "team", "created_at" @@ -3124,21 +4801,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "_document_id", - "title", - "user", - "user_agent", - "org", - "operation_type", - "actor_id", "@timestamp", - "actor", - "team", + "_document_id", "action", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", + "title", + "operation_type", + "team", "number" ] }, @@ -3147,17 +4835,31 @@ "description": "A global announcement banner was created for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3168,16 +4870,30 @@ "description": "A global announcement banner was removed from the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3188,18 +4904,32 @@ "description": "A global announcement banner was updated for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", "old_message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3210,23 +4940,31 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise" }, @@ -3235,19 +4973,33 @@ "description": "A domain was approved for an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3256,18 +5008,33 @@ "description": "A domain was added to an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3276,18 +5043,33 @@ "description": "A domain was removed from an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3296,18 +5078,33 @@ "description": "A domain was verified for an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3316,18 +5113,30 @@ "description": "A new GitHub Actions self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -3336,20 +5145,30 @@ "description": "A GitHub Actions self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -3358,18 +5177,31 @@ "description": "A GitHub Actions self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows" ], "docs_reference_titles": "Removing self-hosted runners" @@ -3379,18 +5211,31 @@ "description": "A GitHub Actions self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3399,20 +5244,33 @@ "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -3421,19 +5279,31 @@ "description": "A GitHub Actions self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3442,19 +5312,32 @@ "description": "A GitHub Actions runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -3463,24 +5346,36 @@ "description": "The configuration of a GitHub Actions self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3489,14 +5384,32 @@ "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -3505,14 +5418,32 @@ "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -3521,42 +5452,70 @@ "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ - "business_id", - "runner_id", - "runner_name", - "source_version", - "target_version", - "runner_group_id", - "runner_group_name", - "action", + "@timestamp", "_document_id", - "operation_type", - "created_at", - "@timestamp" - ], - "docs_reference_titles": "Self-hosted runners" - }, - { - "action": "enterprise_team.add_member", - "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.", - "docs_reference_links": "N/A", - "fields": [ + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "runner_id", + "runner_name", + "source_version", + "target_version", + "runner_group_id", + "runner_group_name", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Self-hosted runners" + }, + { + "action": "enterprise_team.add_member", + "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "user", - "business", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3564,21 +5523,33 @@ "description": "A license for GitHub Copilot was assigned to an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3586,17 +5557,30 @@ "description": "A license for GitHub Copilot was unassigned from an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3607,17 +5591,30 @@ "description": "A new enterprise team was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3627,17 +5624,30 @@ "description": "An enterprise team was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3648,22 +5658,32 @@ "description": "A member was removed from the enterprise team or an IdP group linked to an enterprise team, or an IdP group was unlinked from an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "business_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "user", - "business", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3671,18 +5691,31 @@ "description": "The name of an enterprise team was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "business_id", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3693,22 +5726,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3717,22 +5759,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", - "repo", - "repo_id", - "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3740,28 +5792,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3770,27 +5828,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -3799,25 +5865,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3826,26 +5900,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3854,21 +5935,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -3877,22 +5970,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3901,25 +6004,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3928,22 +6040,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", - "visibility", - "environment_name", - "repo", - "repo_id", - "public_repo", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "visibility", + "environment_name", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -3952,21 +6076,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -3977,27 +6111,33 @@ "description": "A user was added to an external group.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "external_group", - "external_group_id", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "external_group", + "external_group_id", "created_at", "operation_type", - "business", - "business_id", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -4005,19 +6145,31 @@ "description": "An external group was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at", "scim_group_id" ] }, @@ -4026,22 +6178,33 @@ "description": "An external group was linked to a GitHub team.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "external_group", - "programmatic_access_type", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -4049,21 +6212,31 @@ "description": "An external group was created.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -4071,26 +6244,32 @@ "description": "A user was removed from an external group.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "external_group", - "external_group_id", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "external_group", + "external_group_id", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -4098,15 +6277,29 @@ "description": "Failed external group SCIM API request.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", @@ -4114,15 +6307,9 @@ "url_path", "scim_group_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4131,30 +6318,38 @@ "description": "Successful external group SCIM API request. Excludes GET API requests.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", "status_code", "url_path", "scim_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4163,18 +6358,31 @@ "description": "An external group was unlinked to a GitHub team.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "external_group" ] }, @@ -4183,22 +6391,32 @@ "description": "An external group was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "scim_group_id", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at", + "scim_group_id" ] }, { @@ -4206,25 +6424,33 @@ "description": "An external group's display name was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", "external_group", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -4232,20 +6458,31 @@ "description": "An external identity was deprovisioned, suspending the linked GitHub user.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -4253,17 +6490,31 @@ "description": "An external identity was created and linked to a GitHub user.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "scim_user_id", - "request_access_security_header" + "scim_user_id" ] }, { @@ -4271,15 +6522,29 @@ "description": "Failed external identity SCIM API request.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", @@ -4287,15 +6552,9 @@ "url_path", "scim_user_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4304,30 +6563,38 @@ "description": "Successful external identity SCIM API request. Excludes GET API requests.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", "status_code", "url_path", "scim_user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4336,18 +6603,31 @@ "description": "An external identity was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "scim_user_id", - "request_access_security_header" + "scim_user_id" ] }, { @@ -4355,42 +6635,65 @@ "description": "A gist was created.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "user", - "gist_id", "@timestamp", - "created_at", - "operation_type", - "user_agent", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "action", - "_document_id", - "token_scopes", - "programmatic_access_type" - ] - }, - { - "action": "gist.destroy", - "description": "A gist was deleted.", - "docs_reference_links": "N/A", - "fields": [ + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "gist_id", - "visibility", "created_at", - "_document_id", - "user", - "request_id", "operation_type", + "visibility" + ] + }, + { + "action": "gist.destroy", + "description": "A gist was deleted.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "@timestamp", - "programmatic_access_type" + "gist_id", + "visibility", + "created_at", + "operation_type" ] }, { @@ -4398,21 +6701,32 @@ "description": "The visibility of a gist was updated.", "docs_reference_links": "N/A", "fields": [ - "action", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", - "user", - "gist_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "visibility", - "user_id", - "created_at", - "_document_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "gist_id", + "visibility", + "created_at" ] }, { @@ -4420,19 +6734,30 @@ "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4441,20 +6766,30 @@ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4463,19 +6798,30 @@ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4484,22 +6830,33 @@ "description": "An SSH key was added to a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -4508,23 +6865,34 @@ "description": "An SSH key was removed from a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", "explanation", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -4533,23 +6901,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4557,18 +6934,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -4579,20 +6966,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -4602,18 +6999,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "created_at", - "user_id", "@timestamp", - "user", - "operation_type", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -4621,18 +7030,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "created_at", - "_document_id", + "user_id", "user_agent", - "@timestamp", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -4640,25 +7061,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -4666,25 +7097,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -4692,26 +7132,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -4720,25 +7169,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -4746,26 +7204,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -4773,21 +7240,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -4796,19 +7274,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -4816,21 +7307,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -4839,19 +7341,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -4862,20 +7378,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -4885,24 +7413,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -4913,23 +7452,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -4940,21 +7491,33 @@ "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", "operation_type", - "@timestamp", "integration", - "action", - "user_agent", "reason", - "_document_id", - "org", - "org_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -4965,20 +7528,32 @@ "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ "@timestamp", - "actor_id", - "org", "_document_id", - "requester", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "requester", "created_at", "url", - "org_id", - "request_id", "operation_type", - "actor", "integration", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -4988,20 +7563,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", - "request_id", - "name", - "repository_selection", - "actor_id", - "integration", - "user", - "user_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "repository_selection", + "integration", + "operation_type", + "created_at", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -5011,19 +7599,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -5032,20 +7634,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -5055,20 +7670,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -5077,20 +7705,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -5099,20 +7740,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -5120,19 +7773,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -5141,19 +7807,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -5162,17 +7841,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -5185,21 +7877,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", - "user_id", - "name", - "transfer_to_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "name", + "transfer_to_id", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -5213,17 +7918,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -5235,19 +7953,30 @@ "description": "An IP allow list was disabled.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "actor", - "request_id", - "org", - "user_agent", + "@timestamp", "_document_id", - "user_id", + "action", + "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "@timestamp", - "user" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5255,19 +7984,30 @@ "description": "An IP allow list was disabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5275,17 +8015,28 @@ "description": "IP allow list user level enforcement was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5295,20 +8046,29 @@ "description": "An IP allow list was enabled.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "user_id", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "business_id", - "_document_id", - "action", - "@timestamp", + "user_id", "user_agent", - "actor_id", "operation_type", - "org", "created_at" ] }, @@ -5317,19 +8077,30 @@ "description": "An IP allow list was enabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5337,17 +8108,28 @@ "description": "IP allow list user level enforcement was enabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5357,24 +8139,32 @@ "description": "An IP address was added to an IP allow list.", "docs_reference_links": "N/A", "fields": [ - "active", - "org", - "ip_allow_list_entry", "@timestamp", "_document_id", - "operation_type", - "created_at", - "user_agent", "action", - "request_id", + "actor", "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "business", - "actor", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", + "ip_allow_list_entry", + "operation_type", + "created_at" ] }, { @@ -5382,24 +8172,32 @@ "description": "An IP address was deleted from an IP allow list.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "ip_allow_list_entry", - "org", - "operation_type", - "created_at", - "active", "action", - "@timestamp", + "actor", + "actor_id", "business", "business_id", - "user_agent", + "hashed_token", + "org", "org_id", - "actor", - "actor_id", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ip_allow_list_entry", + "operation_type", + "created_at", + "active" ] }, { @@ -5407,19 +8205,32 @@ "description": "An IP address or its description was changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "actor_id", "ip_allow_list_entry", - "active", - "org_id", - "@timestamp" + "active" ] }, { @@ -5427,18 +8238,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5446,21 +8269,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -5468,21 +8304,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -5490,22 +8339,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -5513,19 +8375,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -5536,21 +8411,36 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "actor", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", "marketplace_listing", "has_free_trial", - "user_agent", - "request_id", - "actor_id", "yearly_price_in_cents", "description", "bullets", "monthly_price_in_cents", - "marketplace_listing_plan", - "_document_id" + "marketplace_listing_plan" ] }, { @@ -5558,22 +8448,37 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "marketplace_listing_plan", "marketplace_listing", "description", "bullets", "has_free_trial", "created_at", - "actor_id", "operation_type", - "_document_id", - "action", - "user_agent", - "request_id", - "actor", "monthly_price_in_cents", - "yearly_price_in_cents", - "@timestamp" + "yearly_price_in_cents" ] }, { @@ -5581,44 +8486,74 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor", - "marketplace_listing_plan", - "_document_id", - "request_id", - "description", - "yearly_price_in_cents", "@timestamp", - "created_at", - "actor_id", - "bullets", - "has_free_trial", - "marketplace_listing", - "user_agent", - "monthly_price_in_cents", + "_document_id", "action", - "operation_type" - ] + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "marketplace_listing_plan", + "description", + "yearly_price_in_cents", + "created_at", + "bullets", + "has_free_trial", + "marketplace_listing", + "monthly_price_in_cents", + "operation_type" + ] }, { "action": "marketplace_listing_plan.update", "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "monthly_price_in_cents", - "marketplace_listing", + "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "monthly_price_in_cents", + "marketplace_listing", "description", "bullets", "yearly_price_in_cents", - "request_id", - "actor_id", "has_free_trial", "marketplace_listing_plan", - "user_agent", - "@timestamp", "operation_type", - "actor", "created_at" ] }, @@ -5627,22 +8562,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -5650,22 +8598,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -5673,19 +8634,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5693,21 +8666,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5717,16 +8699,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5736,18 +8731,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5757,14 +8765,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -5772,19 +8796,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5792,18 +8827,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5811,23 +8858,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -5835,20 +8890,30 @@ "description": "An OAuth access token was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", "fields": [ - "_document_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "user", - "user_id", - "created_at", + "_document_id", "action", + "actor", "actor_id", - "request_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" @@ -5859,19 +8924,30 @@ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", "fields": [ "@timestamp", - "user_agent", - "action", - "operation_type", "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_id", + "user_agent", + "operation_type", + "created_at", "explanation", - "hashed_token", - "actor_id", - "token_scopes", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" @@ -5881,19 +8957,30 @@ "description": "An OAuth access token was regenerated.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "_document_id", - "created_at", "@timestamp", - "operation_type", + "_document_id", "action", - "user_agent", - "request_id", "actor", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "oauth_application_name" ] }, @@ -5902,16 +8989,28 @@ "description": "An OAuth access token was revoked.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "request_access_security_header", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -5921,18 +9020,30 @@ "description": "An OAuth access token was updated.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -5940,20 +9051,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5962,20 +9085,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -5984,20 +9119,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6006,20 +9153,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6028,19 +9187,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6049,20 +9221,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6071,20 +9255,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6094,18 +9290,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user_agent", - "org_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "oauth_application_id", - "action", "created_at", - "actor", - "actor_id", - "oauth_application", - "_document_id", - "request_id" + "oauth_application" ] }, { @@ -6113,19 +9322,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6134,15 +9356,32 @@ "description": "An OAuth application was unsuspended for a user or organization account.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "operation_type", - "org_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "oauth_application_id", "oauth_application", - "org", - "created_at", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6151,47 +9390,65 @@ "description": "An authorization for an OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ - "operation_type", - "user_agent", - "user_id", - "actor", - "org_id", + "@timestamp", "_document_id", - "request_id", "action", - "@timestamp", - "created_at", + "actor", "actor_id", - "user", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "oauth_application_name" - ], - "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" - }, + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_is_bot", + "oauth_application_name" + ], + "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + }, { "action": "oauth_authorization.destroy", "description": "An authorization for an OAuth application was deleted.", "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", "fields": [ - "user_agent", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "actor", "created_at", "explanation", - "user", - "user_id", - "org_id", - "action", - "actor_id", - "token_scopes", "actor_is_bot", "oauth_application_name" ], @@ -6202,20 +9459,31 @@ "description": "An authorization for an OAuth application was updated.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", - "actor_id", "user_agent", - "@timestamp", "operation_type", - "action", - "user", "created_at", - "_document_id", "actor_is_bot", - "request_access_security_header", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -6225,17 +9493,28 @@ "description": "An invitation sent to an organization to join an enterprise was accepted.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6246,20 +9525,30 @@ "description": "A billing manager was added to an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "org", - "user_id", "action", - "created_at", - "org_id", - "user", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" }, @@ -6268,21 +9557,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -6291,24 +9590,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -6316,21 +9625,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -6338,20 +9657,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -6359,43 +9688,61 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "user", - "user_id", - "org", - "org_id", - "business", - "business_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", - "token_scopes" - ] - }, - { - "action": "org.advanced_security_enabled_for_new_repos", - "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", + "created_at" + ] + }, + { + "action": "org.advanced_security_enabled_for_new_repos", + "description": "GitHub Advanced Security was enabled for new repositories in an organization.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6403,22 +9750,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -6426,21 +9781,31 @@ "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "new_policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "new_policy", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -6450,19 +9815,30 @@ "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -6471,19 +9847,30 @@ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -6493,16 +9880,29 @@ "description": "A user initiated a background job to delete an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "@timestamp", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "created_at" ] }, @@ -6511,16 +9911,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_agent", - "action", "@timestamp", - "actor_id", - "org_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -6529,18 +9942,31 @@ "description": "An organization owner blocked a user from accessing the organization's repositories.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", "fields": [ - "actor", - "user_agent", - "org_id", - "created_at", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "blocked_user", + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" }, @@ -6549,19 +9975,30 @@ "description": "An invitation for an organization to join an enterprise was revoked", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "initiated_from" ], "docs_reference_titles": "Adding organizations to your enterprise" @@ -6571,22 +10008,33 @@ "description": "An invitation sent to a user to join an organization was revoked.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "org_id", - "request_id", - "email", "@timestamp", - "actor", + "_document_id", "action", - "operation_type", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "email", + "operation_type", "invitation_id", - "_document_id", "created_at", - "invitee_email", - "token_scopes", - "programmatic_access_type" + "invitee_email" ] }, { @@ -6594,19 +10042,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -6614,23 +10073,31 @@ "description": "Autofix for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6638,21 +10105,31 @@ "description": "Autofix for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6660,23 +10137,31 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6684,23 +10169,31 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6708,21 +10201,30 @@ "description": "Code scanning using the default setup was disabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -6731,21 +10233,30 @@ "description": "Code scanning using the default setup was enabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -6754,16 +10265,29 @@ "description": "The interaction limit for collaborators only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "request_id", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" @@ -6773,17 +10297,30 @@ "description": "The interaction limit for prior contributors only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "operation_type", "@timestamp", - "created_at", - "user_agent", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", - "actor", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6792,17 +10329,30 @@ "description": "The interaction limit for existing users only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", "_document_id", - "operation_type", - "actor_id", - "org_id", "action", - "created_at", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6812,16 +10362,29 @@ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ "@timestamp", - "created_at", "_document_id", - "actor_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "action", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6830,17 +10393,30 @@ "description": "The interaction limit for prior contributors only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "operation_type", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6849,17 +10425,30 @@ "description": "The interaction limit for existing users only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "actor_id", - "request_id", + "@timestamp", + "_document_id", "action", - "created_at", - "user_agent", "actor", - "_document_id", - "org_id", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6868,22 +10457,30 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" }, @@ -6892,17 +10489,28 @@ "description": "An invitation for an organization to join an enterprise was confirmed.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6913,18 +10521,30 @@ "description": "An organization was created.", "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", "fields": [ - "request_id", - "org", - "actor_id", - "actor", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "org_id", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" }, @@ -6933,18 +10553,30 @@ "description": "An organization was deleted by a user or staff.", "docs_reference_links": "N/A", "fields": [ - "user_agent", "@timestamp", "_document_id", - "created_at", - "actor", - "org_id", - "org", "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6952,20 +10584,30 @@ "description": "Team creation was limited to owners.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "actor", "@timestamp", "_document_id", - "user", - "user_id", "action", - "created_at", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -6974,19 +10616,30 @@ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -6995,14 +10648,31 @@ "description": "SAML single sign-on was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "sso_url", - "issuer", - "action", "@timestamp", "_document_id", - "created_at", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "issuer", + "created_at", "operation_type" ] }, @@ -7011,17 +10681,30 @@ "description": "A two-factor authentication requirement was disabled for the organization.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "org_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "_document_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7029,19 +10712,30 @@ "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "user", - "action", - "operation_type", "@timestamp", "_document_id", - "created_at", - "user_agent", - "org", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7049,19 +10743,30 @@ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "user", - "action", - "actor_id", - "org_id" + "created_at" ] }, { @@ -7069,19 +10774,30 @@ "description": "Team creation by members was allowed.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "org_id", - "user", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -7090,19 +10806,30 @@ "description": "An organization owner allowed users with read access to create discussions in an organization", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -7111,19 +10838,32 @@ "description": "SAML single sign-on was enabled for the organization.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", - "sso_url", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "@timestamp", - "issuer", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "sso_url", + "created_at", + "issuer" ], "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" }, @@ -7132,17 +10872,30 @@ "description": "Two-factor authentication is now required for the organization.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "actor_id", - "action", - "_document_id", - "org", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" }, @@ -7151,17 +10904,30 @@ "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "org_id", - "manager", "@timestamp", - "request_id", - "actor", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "manager", + "operation_type", "created_at" ] }, @@ -7170,42 +10936,64 @@ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", "docs_reference_links": "N/A", "fields": [ - "org_id", "@timestamp", - "org", - "user_agent", - "request_id", + "_document_id", "action", "actor", "actor_id", - "manager", - "operation_type", - "created_at", - "_document_id" - ] - }, - { - "action": "org.invite_member", - "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", - "fields": [ + "business", + "business_id", + "hashed_token", "org", - "user_id", - "invitation_id", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", + "user_agent", + "manager", "operation_type", + "created_at" + ] + }, + { + "action": "org.invite_member", + "description": "A new user was invited to join an organization.", + "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", + "fields": [ + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", - "created_at", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "invitee_email", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitation_id", + "operation_type", + "created_at", + "invitee_email" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" }, @@ -7214,17 +11002,28 @@ "description": "An organization was invited to join an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7234,19 +11033,30 @@ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7254,19 +11064,30 @@ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "org", - "org_id", - "user_agent", - "actor_id", - "user_id", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7275,16 +11096,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "org_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type", - "_document_id", - "org" + "created_at", + "operation_type" ] }, { @@ -7292,17 +11126,30 @@ "description": "An organization was restored.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "org_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7310,19 +11157,31 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", "fields": [ - "actor", - "operation_type", "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "actor_is_bot", - "request_access_security_header" + "operation_type", + "created_at", + "actor_is_bot" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -7331,18 +11190,29 @@ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "user_id", - "user_agent", - "org_id", - "user", - "action", - "_document_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" @@ -7352,21 +11222,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7374,21 +11253,30 @@ "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ - "org", - "user", - "org_id", - "created_at", - "request_id", "@timestamp", - "action", - "operation_type", - "user_agent", "_document_id", + "action", "actor", "actor_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7396,21 +11284,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -7418,18 +11316,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", "fields": [ - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "actor", - "action", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -7438,19 +11348,31 @@ "description": "An organization was renamed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "_document_id", "@timestamp", - "org", + "_document_id", "action", "actor", - "old_login", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_login", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -7458,20 +11380,30 @@ "description": "An organization member was restored.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", "fields": [ - "user", - "actor", - "user_id", + "@timestamp", "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "actor_id", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" }, @@ -7480,21 +11412,33 @@ "description": "A self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" @@ -7504,21 +11448,31 @@ "description": "A self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7527,23 +11481,33 @@ "description": "The REST API was used to remove a self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -7552,23 +11516,31 @@ "description": "A self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7577,19 +11549,32 @@ "description": "A runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "runner_group_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -7598,25 +11583,36 @@ "description": "The configuration of a self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7625,21 +11621,30 @@ "description": "Automatic partner validation checks have been disabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -7649,21 +11654,30 @@ "description": "Automatic partner validation checks have been enabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -7673,20 +11687,30 @@ "description": "A custom pattern was created for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7695,22 +11719,30 @@ "description": "A custom pattern was removed from secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7719,21 +11751,30 @@ "description": "A custom pattern was published for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7742,21 +11783,30 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7765,22 +11815,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7789,21 +11847,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "business", - "business_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7812,21 +11879,30 @@ "description": "Secret scanning for non-provider patterns was disabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7836,21 +11912,30 @@ "description": "Secret scanning for non-provider patterns was enabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7860,19 +11945,30 @@ "description": "A role or team was added to the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7882,21 +11978,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7906,21 +12011,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7930,19 +12044,30 @@ "description": "A role or team was removed from the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7952,22 +12077,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7976,22 +12109,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8000,22 +12141,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8024,21 +12173,30 @@ "description": "Push protection for secret scanning was disabled.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8047,21 +12205,30 @@ "description": "Push protection for secret scanning was enabled.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8070,22 +12237,30 @@ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8094,22 +12269,30 @@ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8118,26 +12301,35 @@ "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -8146,26 +12338,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8173,28 +12373,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8202,26 +12410,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8229,15 +12445,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -8246,26 +12479,64 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", - "org", - "runner_id", - "runner_name", - "action", + "@timestamp", "_document_id", - "operation_type", - "created_at", - "@timestamp" - ], - "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" - }, - { - "action": "org.self_hosted_runner_updated", - "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", - "fields": [ - "org_id", - "runner_id", - "runner_name", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_id", + "runner_name", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" + }, + { + "action": "org.self_hosted_runner_updated", + "description": "The runner application was updated. This event is not included in the JSON/CSV export.", + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_id", + "runner_name", "source_version", "target_version", "runner_group_id", @@ -8278,20 +12549,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -8300,16 +12582,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -8320,18 +12615,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -8340,17 +12648,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", "_document_id", - "org_id", - "operation_type", + "action", "actor", "actor_id", - "@timestamp", - "request_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", - "action" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8358,18 +12679,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -8378,18 +12711,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -8398,18 +12744,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -8418,42 +12776,64 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", "actor_id", - "org_id", - "@timestamp", - "org", - "issuer", "business", - "operation_type", - "created_at", - "request_id", "business_id", - "_document_id", - "actor_is_bot", - "request_access_security_header" - ] - }, - { - "action": "org.transform", - "description": "A user account was converted into an organization.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization", - "fields": [ - "actor", - "_document_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "issuer", "operation_type", + "created_at", + "actor_is_bot" + ] + }, + { + "action": "org.transform", + "description": "A user account was converted into an organization.", + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "@timestamp", - "created_at", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "owner", - "request_access_security_header" + "operation_type", + "created_at", + "owner" ], "docs_reference_titles": "Converting a user into an organization" }, @@ -8462,19 +12842,32 @@ "description": "A user was unblocked from an organization.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", "fields": [ - "oauth_application_id", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", - "@timestamp", - "request_id", - "created_at", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "blocked_user", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" }, @@ -8483,23 +12876,34 @@ "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "updated_allowed_types", "old_policy", - "updated_access_policy", - "programmatic_access_type", - "request_access_security_header" + "updated_access_policy" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" }, @@ -8508,20 +12912,32 @@ "description": "The default repository permission level for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", + "created_at", "permission", - "actor_id", - "old_permission", - "_document_id", - "programmatic_access_type" + "old_permission" ] }, { @@ -8530,20 +12946,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -8551,17 +12978,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -8571,20 +13011,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -8593,19 +13044,32 @@ "description": "An organization's SAML provider settings were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "sso_url", - "actor_id", - "operation_type", "@timestamp", - "issuer", - "org", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "operation_type", + "issuer", + "created_at" ] }, { @@ -8613,19 +13077,31 @@ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", "fields": [ - "request_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "operation_type", - "_document_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "@timestamp", - "created_at", - "request_access_security_header" - ], + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" }, { @@ -8633,20 +13109,33 @@ "description": "A domain was approved for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "org_id", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" }, @@ -8655,16 +13144,31 @@ "description": "A domain was added to an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "created_at", + "@timestamp", "_document_id", - "domain_name", "action", - "request_id", + "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "domain_name", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8673,14 +13177,29 @@ "description": "A domain was removed from an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", "fields": [ - "action", - "domain_name", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "domain_name", "operation_type", "created_at" ], @@ -8691,16 +13210,31 @@ "description": "A domain was verified for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "operation_type", - "domain_name", "@timestamp", - "user_agent", - "request_id", - "actor", - "action", - "created_at", "_document_id", - "actor_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "domain_name", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8709,20 +13243,31 @@ "description": "An entire package was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" @@ -8732,23 +13277,34 @@ "description": "A package was published or republished to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "ecosystem", "version_count", "is_republished", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -8757,21 +13313,32 @@ "description": "A specific package version was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "version", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "ecosystem", "actor_is_bot" ], @@ -8782,21 +13349,34 @@ "description": "A specific package version was published or republished to a package.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "ecosystem", "package", "version", - "actor_id", - "user_agent", "is_republished", - "actor", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -8805,20 +13385,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -8827,17 +13421,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", - "owner_type", - "domain", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", + "owner_type", + "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8848,20 +13457,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -8870,19 +13493,31 @@ "description": "A new passkey was added.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8890,19 +13525,31 @@ "description": "A new passkey was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8910,18 +13557,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8929,16 +13588,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8946,18 +13619,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8965,18 +13650,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8987,22 +13685,31 @@ "description": "The configured restriction for access to resources via personal access tokens was disabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9010,22 +13717,31 @@ "description": "The configured restriction for access to resources via personal access tokens was enabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9033,18 +13749,28 @@ "description": "The configured restriction for access to resources via personal access tokens was reset and delegated to organizations.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9055,18 +13781,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9077,18 +13816,28 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9099,18 +13848,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9121,18 +13880,28 @@ "description": "Triggered when the enterprise delegates to the organizations when to require approval for fine-grained personal access tokens before the tokens can access organization resources.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9143,17 +13912,30 @@ "description": "Triggered when you create a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9163,19 +13945,31 @@ "description": "Triggered when you regenerate a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9183,12 +13977,29 @@ "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", "fields": [ - "user_programmatic_access_name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", "operation_type" ], @@ -9199,20 +14010,32 @@ "description": "Triggered when you delete a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "explanation", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9220,23 +14043,34 @@ "description": "A personal access token expiration limit was set.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "token_expiration", "old_token_expiration", "exempt_administrators", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9244,21 +14078,32 @@ "description": "A personal access token expiration limit was unset.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "programmatic_access_type", - "old_token_expiration", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_token_expiration", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9266,17 +14111,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9287,18 +14145,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9310,17 +14181,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9332,17 +14216,30 @@ "description": "A fine-grained personal access token was updated.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9353,15 +14250,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9371,17 +14283,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -9391,15 +14314,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9409,17 +14347,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9429,17 +14378,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9449,17 +14409,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9469,17 +14440,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9489,17 +14471,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -9509,17 +14504,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9527,20 +14535,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -9550,25 +14569,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -9576,20 +14607,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9597,25 +14640,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9623,17 +14678,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -9641,17 +14709,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -9659,18 +14740,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -9679,18 +14772,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -9699,19 +14804,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -9719,17 +14835,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -9741,22 +14870,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -9764,19 +14902,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -9784,17 +14933,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9802,18 +14964,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -9821,20 +14996,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9842,18 +15027,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -9862,18 +15059,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -9882,16 +15091,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -9903,21 +15125,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -9925,22 +15159,32 @@ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", "fields": [ - "repo", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "name", "created_at", - "_document_id", "operation_type", - "actor", - "repo_id", - "org", - "request_id", - "actor_id", - "oauth_application_id", - "@timestamp", - "programmatic_access_type" + "oauth_application_id" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" }, @@ -9949,29 +15193,34 @@ "description": "A protected branch allowance was given to a specific user, team or integration.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "authorized_actors", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -9979,24 +15228,32 @@ "description": "Branch protection was enabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "repo_id", - "user_id", "@timestamp", - "user_agent", - "repo", - "name", - "org_id", - "user", "_document_id", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", "created_at", "authorized_actor_names", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -10007,21 +15264,31 @@ "description": "Branch protection was disabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "repo", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", - "request_id", - "repo_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "name", + "operation_type", "created_at", - "_document_id", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -10032,22 +15299,32 @@ "description": "Enforcement of dismissing stale pull requests was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "dismiss_stale_reviews_on_push", - "org_id", - "action", - "created_at", - "request_id", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismiss_stale_reviews_on_push", + "created_at", "operation_type", - "actor", - "repo", - "org", - "name", - "programmatic_access_type" + "name" ] }, { @@ -10055,24 +15332,34 @@ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "authorized_actors_only", "authorized_actors", "created_at", - "user_agent", "name", - "_document_id", - "org_id", - "request_id", - "@timestamp", - "actor_id", - "org", - "action", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -10080,30 +15367,37 @@ "description": "A branch protection requirement was overridden by a repository administrator.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "actor", "reasons", - "@timestamp", "before", "after", - "actor_id", - "repo", "operation_type", - "user_agent", "branch", "overridden_codes", - "org", - "org_id", - "action", - "_document_id", - "request_id", "referrer", - "business", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "rule_suite_id" ] @@ -10113,28 +15407,36 @@ "description": "A branch update attempt was rejected.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "request_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "branch", "before", "overridden_codes", "after", - "action", "reasons", - "actor_id", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "actor_is_bot", "rule_suite_id" @@ -10145,23 +15447,32 @@ "description": "Branch protection was enforced for repository administrators.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "admin_enforced", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "name", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "action", "repo_id", - "org_id", - "_document_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "admin_enforced", + "operation_type", + "name", + "created_at" ] }, { @@ -10169,22 +15480,32 @@ "description": "Branch deletion was enabled or disabled for a protected branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "operation_type", - "request_id", - "repo", "@timestamp", - "org_id", - "org", - "action", - "allow_deletions_enforcement_level", "_document_id", - "created_at", - "actor_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_deletions_enforcement_level", + "created_at" ] }, { @@ -10192,23 +15513,32 @@ "description": "Force pushes were enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "actor_id", - "name", + "@timestamp", "_document_id", + "action", "actor", - "repo", - "operation_type", - "request_id", - "allow_force_pushes_enforcement_level", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_force_pushes_enforcement_level", + "created_at" ] }, { @@ -10216,24 +15546,33 @@ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "ignore_approvals_from_contributors", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -10242,22 +15581,32 @@ "description": "Required linear commit history was enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "operation_type", "actor", - "linear_history_requirement_enforcement_level", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "linear_history_requirement_enforcement_level", "name", - "org_id", - "repo_id", - "org", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ] }, { @@ -10265,24 +15614,33 @@ "description": "Fork syncing was enabled or disabled for a read-only branch", "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "lock_allows_fetch_and_merge", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "lock_allows_fetch_and_merge", + "public_repo", + "created_at", + "operation_type" ], "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -10291,27 +15649,34 @@ "description": "The enforcement of a branch lock was updated.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "enforcement_level", "lock_branch_enforcement_level", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -10320,18 +15685,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -10342,24 +15720,33 @@ "description": "A branch name pattern was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "old_name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "old_name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -10367,25 +15754,32 @@ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", "docs_reference_links": "N/A", "fields": [ - "name", - "org_id", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "@timestamp", + "business", "business_id", - "request_id", - "pull_request_reviews_enforcement_level", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "business", - "user_agent", - "created_at", "repo_id", - "operation_type", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "pull_request_reviews_enforcement_level", + "created_at", + "operation_type" ] }, { @@ -10393,22 +15787,32 @@ "description": "Enforcement of required code owner review was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "created_at", - "require_code_owner_review", - "operation_type", - "name", - "user_agent", - "action", "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "request_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "require_code_owner_review", + "operation_type", + "name" ] }, { @@ -10416,22 +15820,33 @@ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "require_last_push_approval", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" }, @@ -10440,22 +15855,32 @@ "description": "Enforcement of the required number of approvals before merging was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "required_approving_review_count", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "required_approving_review_count", "created_at", - "actor", "operation_type", - "user_agent", - "name", - "org_id", - "action", - "actor_id", - "_document_id", - "org", - "@timestamp", - "programmatic_access_type" + "name" ] }, { @@ -10463,48 +15888,65 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "user_agent", "@timestamp", "_document_id", - "name", - "repo", "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "business", - "actor_id", - "operation_type", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "required_status_checks_enforcement_level", - "org", + "token_id", "token_scopes", - "programmatic_access_type" - ] - }, - { - "action": "protected_branch.update_signature_requirement_enforcement_level", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "required_status_checks_enforcement_level" + ] + }, + { + "action": "protected_branch.update_signature_requirement_enforcement_level", "description": "Enforcement of required commit signing was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "name", "@timestamp", - "created_at", "_document_id", - "request_id", - "repo_id", - "org", - "org_id", "action", "actor", "actor_id", - "signature_requirement_enforcement_level", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "programmatic_access_type" + "operation_type", + "name", + "created_at", + "signature_requirement_enforcement_level" ] }, { @@ -10512,22 +15954,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "created_at", - "repo_id", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "name", - "actor", - "repo", "operation_type", - "action", - "strict_required_status_checks_policy", - "programmatic_access_type" + "strict_required_status_checks_policy" ] }, { @@ -10535,23 +15987,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -10560,24 +16023,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -10586,20 +16060,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10608,21 +16096,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -10632,22 +16133,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10656,25 +16169,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10683,23 +16206,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", - "created_at", - "key", - "fingerprint", - "actor_id", "actor", - "title", - "user_agent", - "user_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "read_only", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "key", + "fingerprint", + "title", + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10708,18 +16242,32 @@ "description": "A pull request was closed without being merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" @@ -10729,21 +16277,32 @@ "description": "A pull request was converted to a draft.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" }, @@ -10752,19 +16311,32 @@ "description": "A pull request was created.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -10775,23 +16347,35 @@ "description": "A review was requested on a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -10801,17 +16385,31 @@ "description": "A pull request was marked as in progress.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -10819,19 +16417,32 @@ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -10839,19 +16450,32 @@ "description": "A pull request was merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" @@ -10861,21 +16485,32 @@ "description": "A pull request was marked as ready for review.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" }, @@ -10884,27 +16519,34 @@ "description": "A pull request was rebased.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", - "pull_request_url", - "pull_request_title", - "user", - "user_id", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", + "pull_request_url", + "pull_request_title", + "public_repo", + "created_at", + "operation_type" ] }, { @@ -10912,23 +16554,35 @@ "description": "A review request was removed from a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" }, @@ -10937,18 +16591,32 @@ "description": "A pull request was reopened after previously being closed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -10956,19 +16624,31 @@ "description": "A review comment was added to a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "comment_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -10978,20 +16658,31 @@ "description": "A review comment on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", "@timestamp", "_document_id", - "repo", - "created_at", - "request_id", - "comment_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "comment_id", + "operation_type" ] }, { @@ -10999,18 +16690,31 @@ "description": "A review comment on a pull request was changed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "request_id", - "actor_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "_document_id", - "@timestamp", - "comment_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "comment_id" ] }, { @@ -11018,21 +16722,33 @@ "description": "A review on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ] }, { @@ -11040,20 +16756,33 @@ "description": "A review on a pull request was dismissed.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" }, @@ -11062,19 +16791,33 @@ "description": "A review on a pull request was submitted.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" @@ -11084,23 +16827,33 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", - "actor_id", - "user_id", - "created_at", - "user_agent", - "actor", - "action", - "repo", - "visibility", "_document_id", - "previous_visibility", - "programmatic_access_type" - ], + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility", + "previous_visibility" + ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, { @@ -11108,21 +16861,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -11131,25 +16893,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -11158,23 +16927,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -11183,24 +16960,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -11209,23 +16993,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -11235,22 +17027,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -11259,19 +17060,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -11280,24 +17094,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -11306,24 +17130,32 @@ "description": "Autofix for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "public_repo", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11331,24 +17163,32 @@ "description": "Autofix for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11356,24 +17196,32 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11381,24 +17229,32 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11406,23 +17262,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -11433,17 +17298,29 @@ "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -11453,17 +17330,29 @@ "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -11473,25 +17362,31 @@ "description": "Code scanning using the default setup was disabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -11500,26 +17395,34 @@ "description": "Code scanning using the default setup was enabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "query_suite", "threat_model", - "languages", - "request_access_security_header" + "languages" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -11528,25 +17431,34 @@ "description": "Code scanning using the default setup was updated for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "query_suite", - "threat_model", - "languages", - "repo", - "repo_id", - "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "query_suite", + "threat_model", + "languages", + "public_repo", + "created_at", + "operation_type", "actor_is_bot" ], "docs_reference_titles": "Configuring default setup for code scanning" @@ -11556,20 +17468,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "visibility", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11577,17 +17500,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11596,15 +17532,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -11615,16 +17564,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11634,17 +17596,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11654,19 +17629,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11675,17 +17661,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11694,26 +17693,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -11722,30 +17727,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ - "repo", - "user_id", - "visibility", - "repo_id", - "user", - "request_id", - "actor_id", - "action", - "operation_type", - "request_category", "@timestamp", - "created_at", "_document_id", + "action", "actor", - "user_agent", - "org", - "oauth_application_id", - "org_id", - "request_method", + "actor_id", "business", "business_id", - "public_repo", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "request_category", + "created_at", + "oauth_application_id", + "request_method", + "public_repo", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -11755,20 +17765,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -11777,25 +17798,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -11804,23 +17833,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -11828,25 +17868,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -11856,17 +17905,30 @@ "description": "A repository was archived on disk.", "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories", "fields": [ - "actor_id", - "repo", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", - "repo_id", - "actor", "action", - "user_agent" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/archiving-a-github-repository/archiving-repositories" }, @@ -11875,23 +17937,32 @@ "description": "A source code archive of a repository was downloaded as a ZIP file.", "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "created_at", "operation_type", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" @@ -11901,62 +17972,95 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "visibility", - "repo_id", - "created_at", - "actor", - "action", - "@timestamp", "org_id", - "request_id", + "programmatic_access_type", "repo", - "_document_id" - ] - }, - { - "action": "repo.noindex", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "visibility", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", - "actor_id", - "created_at", + "token_id", + "token_scopes", "user", - "operation_type", - "actor", - "user_agent", - "repo", "user_id", - "public_repo" + "user_agent", + "operation_type", + "visibility", + "created_at" ] }, { - "action": "repo.override_unlock", - "description": "The repository was unlocked.", + "action": "repo.noindex", + "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", "operation_type", + "public_repo" + ] + }, + { + "action": "repo.override_unlock", + "description": "The repository was unlocked.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "created_at", - "_document_id" + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -11964,20 +18068,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "action", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "operation_type", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "visibility", - "actor", - "user_id" + "visibility" ] }, { @@ -11985,23 +18100,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -12009,21 +18134,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -12031,21 +18166,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -12053,22 +18198,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -12076,21 +18230,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -12098,20 +18262,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -12119,22 +18294,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -12142,18 +18326,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -12161,22 +18359,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -12184,21 +18392,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -12206,18 +18424,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -12226,22 +18456,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12250,24 +18489,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12276,23 +18523,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -12300,26 +18557,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -12328,21 +18590,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -12351,25 +18622,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -12377,22 +18654,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -12401,20 +18688,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "visibility", - "operation_type", - "repo", + "@timestamp", "_document_id", - "user", - "user_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "@timestamp", - "request_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -12422,19 +18720,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -12442,17 +18751,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -12461,17 +18785,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -12480,7 +18819,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -12495,46 +18855,66 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "public_repo" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" - }, - { - "action": "repo.set_actions_private_fork_pr_approvals_policy", - "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", + "created_at", + "operation_type", + "public_repo" + ], + "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + }, + { + "action": "repo.set_actions_private_fork_pr_approvals_policy", + "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -12545,21 +18925,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -12568,22 +18959,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -12592,21 +18993,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -12615,22 +19027,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -12641,16 +19063,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -12659,22 +19092,31 @@ "description": "Temporary access was enabled for a repository.", "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing user-owned repositories in your enterprise" }, @@ -12684,22 +19126,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -12708,23 +19161,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -12734,19 +19197,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -12754,21 +19227,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -12777,24 +19260,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -12802,25 +19294,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12829,24 +19328,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12855,25 +19364,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12882,22 +19399,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12906,26 +19432,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -12933,31 +19467,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "created_at", - "oauth_application_id", - "user", - "@timestamp", - "repo", - "operation_type", - "request_id", - "org_id", "actor_id", - "visibility", - "old_permission", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "visibility", + "old_permission", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12966,24 +19507,30 @@ "description": "Branch protections were disabled for the repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -12992,24 +19539,30 @@ "description": "Branch protections were enabled for this repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -13018,21 +19571,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -13040,21 +19603,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -13062,21 +19635,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -13084,20 +19668,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -13105,21 +19701,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -13127,19 +19734,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -13147,31 +19767,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -13180,19 +19808,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -13200,8 +19839,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -13210,23 +19848,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -13251,26 +19898,32 @@ "description": "Automatic partner validation checks have been disabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -13279,26 +19932,32 @@ "description": "Automatic partner validation checks have been enabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -13307,23 +19966,30 @@ "description": "A custom pattern was created for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13333,23 +19999,30 @@ "description": "A custom pattern was removed from secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13359,24 +20032,31 @@ "description": "A custom pattern was published for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13386,24 +20066,31 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -13412,24 +20099,31 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13439,23 +20133,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13465,23 +20166,31 @@ "description": "Secret scanning was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "public_repo", - "programmatic_access_type" + "public_repo" ], "docs_reference_titles": "About secret scanning" }, @@ -13490,22 +20199,30 @@ "description": "Secret scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13513,24 +20230,32 @@ "description": "Secret scanning for non-provider patterns was disabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -13539,24 +20264,32 @@ "description": "Secret scanning for non-provider patterns was enabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -13565,19 +20298,31 @@ "description": "A role or team was added to the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -13586,24 +20331,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -13612,24 +20365,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -13638,19 +20399,31 @@ "description": "A role or team was removed from the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -13659,26 +20432,31 @@ "description": "Secret scanning push protection was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -13687,26 +20465,31 @@ "description": "Secret scanning push protection was enabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -13715,28 +20498,36 @@ "description": "A code security configuration was applied to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13744,27 +20535,35 @@ "description": "A code security configuration failed to attach to the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13772,28 +20571,36 @@ "description": "A code security configuration was removed from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13801,28 +20608,36 @@ "description": "A code security configuration was removed due to a change in repository or enterprise settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13830,29 +20645,37 @@ "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -13861,29 +20684,37 @@ "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "alert_id", - "alert_number", - "ghsa_id", - "action", - "repo", - "repo_id", - "public_repo", - "owner", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "alert_number", + "ghsa_id", + "public_repo", + "owner", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -13892,19 +20723,32 @@ "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ - "operation_type", - "request_id", - "repo_id", "@timestamp", - "user_agent", - "alert_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "alert_id", + "created_at", + "alert_number" ], "docs_reference_titles": "About Dependabot alerts" }, @@ -13913,23 +20757,32 @@ "description": "A Dependabot alert was manually dismissed.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "operation_type", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "alert_id", - "actor", - "repo", "created_at", - "org", - "_document_id", - "action", - "actor_id", "dismiss_reason", - "user", "dismiss_comment", "alert_number", "actor_is_bot" @@ -13940,21 +20793,33 @@ "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "public_repo", "owner", - "_document_id", - "@timestamp", "operation_type", - "token_scopes", "alert_number" ] }, @@ -13963,26 +20828,34 @@ "description": "A Dependabot alert was manually reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type", - "business", - "business_id", "public_repo", - "alert_number", - "request_access_security_header" + "alert_number" ] }, { @@ -13990,21 +20863,32 @@ "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", "docs_reference_links": "N/A", "fields": [ - "alert_id", - "repo", - "operation_type", - "action", - "repo_id", - "_document_id", - "user_agent", - "request_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "alert_id", + "operation_type", + "created_at", + "alert_number" ] }, { @@ -14012,21 +20896,35 @@ "description": "A Dependabot alert was withdrawn.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", "created_at", "active", - "action", - "repository_id", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type" ] }, @@ -14035,20 +20933,30 @@ "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", "fields": [ - "org", + "@timestamp", "_document_id", - "repo", - "org_id", - "operation_type", - "created_at", - "actor", "action", - "@timestamp", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" }, @@ -14057,24 +20965,31 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -14082,26 +20997,32 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14109,23 +21030,30 @@ "description": "Dependabot alerts was disabled.", "docs_reference_links": "N/A", "fields": [ - "repo", - "request_id", - "repo_id", - "action", - "actor_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "_document_id", "user_id", - "operation_type", - "token_scopes", - "programmatic_access_type" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14133,23 +21061,30 @@ "description": "Dependabot alerts was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_agent", - "created_at", "@timestamp", - "repo_id", + "_document_id", "action", - "user", - "repo", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor_id", - "_document_id", - "user_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot" ] }, @@ -14158,18 +21093,31 @@ "description": "Email notification restrictions for an organization or enterprise were disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -14178,19 +21126,31 @@ "description": "Email notification restrictions for an organization or enterprise were enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -14199,14 +21159,28 @@ "description": "GitHub detected a secret and created a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -14220,22 +21194,32 @@ "description": "A secret scanning alert was reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type_display_name" ] }, @@ -14244,28 +21228,37 @@ "description": "A secret scanning alert was resolved.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "resolution", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", + "resolution", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type", "secret_type_display_name", "publicly_leaked", - "multi_repo", - "request_access_security_header" + "multi_repo" ] }, { @@ -14273,25 +21266,32 @@ "description": "A secret scanning alert was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -14299,14 +21299,28 @@ "description": "A secret scanning alert was validated.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "previous_validity", @@ -14323,19 +21337,30 @@ "description": "Secret scanning was disabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -14344,19 +21369,30 @@ "description": "Secret scanning was enabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -14365,20 +21401,30 @@ "description": "Secret scanning was disabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -14387,19 +21433,30 @@ "description": "Secret scanning was enabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -14408,14 +21465,28 @@ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "push_protection_bypass_reason", @@ -14433,25 +21504,33 @@ "description": "A request to bypass secret scanning push protection was approved by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -14460,25 +21539,33 @@ "description": "A request to bypass secret scanning push protection was denied by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", - "request_access_security_header", "request_reviewer_comment" ], "docs_reference_titles": "About push protection" @@ -14488,25 +21575,33 @@ "description": "A user requested to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" }, @@ -14515,22 +21610,35 @@ "description": "A secret scanning scan has completed on this repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "repo_id", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "source", "type", "source_slug", "type_slug", "started_at", "completed_at", - "repo", "public_repo", - "org", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "secret_types", @@ -14544,10 +21652,28 @@ "description": "A security configuration was created", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -14562,15 +21688,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -14588,22 +21707,33 @@ "description": "A default security configuration setting for new repositories was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14612,22 +21742,33 @@ "description": "A default security configuration setting for new repositories was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14636,10 +21777,28 @@ "description": "A security configuration was deleted", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -14654,15 +21813,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -14679,15 +21831,30 @@ "description": "A security configuration policy was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enforcement", "security_configuration_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14697,10 +21864,28 @@ "description": "A security configuration was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -14715,15 +21900,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -14741,18 +21919,30 @@ "description": "A security key was registered for an account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "created_at", - "user_id", - "action", - "operation_type", - "request_id", "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -14760,18 +21950,30 @@ "description": "A security key was removed from an account.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "operation_type", - "_document_id", - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14779,17 +21981,30 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sponsors_listing_id", + "created_at", "operation_type" ] }, @@ -14798,18 +22013,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -14818,16 +22046,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14838,15 +22079,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -14856,15 +22110,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -14873,17 +22142,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -14892,17 +22174,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -14911,16 +22207,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -14930,14 +22239,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -14947,17 +22271,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -14966,37 +22303,63 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", - "user_agent", - "actor" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" - }, - { - "action": "sponsors.sponsored_developer_disable", - "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + }, + { + "action": "sponsors.sponsored_developer_disable", + "description": "A GitHub Sponsors account was disabled.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15005,15 +22368,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -15023,16 +22400,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -15040,15 +22430,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -15059,16 +22462,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -15078,17 +22494,30 @@ "description": "Triggered when you send an email update to your sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", "fields": [ - "request_id", - "actor", - "action", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" }, @@ -15097,17 +22526,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -15118,17 +22560,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -15139,18 +22594,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15160,16 +22626,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15179,17 +22658,30 @@ "description": "You join the waitlist to join GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "actor_id", - "action", "operation_type", - "created_at", - "user", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -15198,16 +22690,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15219,17 +22724,30 @@ "fields": [ "@timestamp", "_document_id", - "fingerprint", - "operation_type", - "openssh_public_key", - "org_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "request_id" + "fingerprint", + "operation_type", + "openssh_public_key", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15238,19 +22756,32 @@ "description": "An SSH certificate authority for an organization or enterprise was deleted.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "created_at", + "@timestamp", "_document_id", - "fingerprint", - "operation_type", + "action", "actor", - "org_id", - "openssh_public_key", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", - "request_id" + "created_at", + "fingerprint", + "operation_type", + "openssh_public_key" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15259,21 +22790,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "user", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "request_id", - "org", - "org_id", - "created_at", - "actor", "action", - "user_id", + "actor", + "actor_id", "business", "business_id", - "@timestamp", - "actor_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15282,19 +22822,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "actor_id", - "user_id", - "org", - "operation_type", - "request_id", "@timestamp", "_document_id", - "actor", - "user", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15303,20 +22854,34 @@ "description": "The verification code expiry time for an organization or enterprise domain was set.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "token_expires_at", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15324,18 +22889,33 @@ "description": "An organization or enterprise domain was unverified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ] }, { @@ -15343,40 +22923,65 @@ "description": "An organization or enterprise domain was verified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "domain_name", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ] - }, - { - "action": "sub_issues.parent_issue_add", - "description": "A parent issue was added to an issue.", - "docs_reference_links": "N/A", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "domain_name", + "operation_type", + "created_at" + ] + }, + { + "action": "sub_issues.parent_issue_add", + "description": "A parent issue was added to an issue.", + "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15384,23 +22989,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15408,23 +23023,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15432,23 +23057,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15456,15 +23091,30 @@ "description": "Triggered when you accept a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -15473,15 +23123,30 @@ "description": "Triggered when you cancel a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -15490,15 +23155,30 @@ "description": "Triggered when you create a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -15507,15 +23187,30 @@ "description": "Triggered when you decline a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -15524,31 +23219,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ] + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] }, { "action": "successor_invitation.revoke", "description": "Triggered when you revoke a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -15557,21 +23282,31 @@ "description": "A member of an organization was added to a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", "fields": [ - "user_agent", - "request_id", - "org_id", - "user_id", - "team", - "user", "@timestamp", - "actor_id", - "created_at", - "operation_type", "_document_id", - "org", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" @@ -15581,22 +23316,31 @@ "description": "A team was given access and permissions to a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "team", - "action", - "operation_type", - "request_id", - "created_at", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "actor_id", - "_document_id", "repo_id", - "user_agent", - "org_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -15605,20 +23349,31 @@ "description": "A child team was created or a child team's parent was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", "fields": [ - "org", "@timestamp", - "created_at", "_document_id", - "team", "action", - "operation_type", "actor", - "request_id", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", + "operation_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" }, @@ -15627,18 +23382,31 @@ "description": "A team's privacy level was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", "fields": [ - "user_agent", - "request_id", - "org", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", "created_at", "operation_type", - "actor_id", - "org_id", - "@timestamp", - "actor", - "_document_id", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" @@ -15648,21 +23416,32 @@ "description": "A new team is created.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "oauth_application_id", + "operation_type", "team", - "org", - "actor", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "team_type" ] }, @@ -15671,21 +23450,31 @@ "description": "A user was demoted from a team maintainer to a team member.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" }, @@ -15694,19 +23483,31 @@ "description": "A team was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "team", "org_id", - "actor_id", - "actor", - "action", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", "operation_type", - "_document_id", - "programmatic_access_type", "team_type" ] }, @@ -15715,19 +23516,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "business_id", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", "actor_id", - "user", "business", - "action", - "request_id", - "created_at", - "user_id", - "_document_id" + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15735,19 +23547,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "operation_type", - "request_id", "actor", - "org", - "created_at", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", - "_document_id" + "operation_type", + "created_at" ] }, { @@ -15755,18 +23578,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", "@timestamp", - "action", "_document_id", - "user_agent", - "user_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business", + "user_id", + "user_agent", "operation_type", - "actor", "created_at" ] }, @@ -15775,22 +23609,31 @@ "description": "A user was promoted from a team member to a team maintainer.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" }, @@ -15799,22 +23642,31 @@ "description": "An organization member was removed from a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", "fields": [ - "request_id", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "team", - "user_id", - "actor", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", + "user_id", "user_agent", - "_document_id", - "token_scopes", - "programmatic_access_type", + "operation_type", + "created_at", + "team", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" @@ -15824,21 +23676,31 @@ "description": "A repository was removed from a team's control.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "org_id", - "repo", - "repo_id", - "action", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "created_at", "team", - "org", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -15846,21 +23708,32 @@ "description": "A team's name was changed.", "docs_reference_links": "N/A", "fields": [ - "name", - "user_agent", - "created_at", - "team", - "operation_type", - "actor_id", - "org", + "@timestamp", + "_document_id", "action", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "_document_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "team", + "operation_type", "team_type" ] }, @@ -15869,17 +23742,30 @@ "description": "Team synchronization with a tenant was disabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "request_id", - "org_id", "actor_id", - "operation_type", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -15888,19 +23774,30 @@ "description": "Team synchronization with a tenant was enabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ - "org_id", - "business_id", - "actor", - "created_at", - "user_agent", "@timestamp", - "operation_type", - "business", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -15909,46 +23806,68 @@ "description": "A team's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "team", - "org_id", "@timestamp", - "org", "_document_id", - "old_permission", - "request_id", - "repo", "action", - "repo_id", "actor", - "operation_type", - "created_at", - "user_agent", - "permission", - "new_repo_permission", - "new_repo_base_role", - "old_repo_permission", - "old_repo_base_role", - "token_scopes", - "programmatic_access_type" - ] - }, - { - "action": "trusted_device.register", - "description": "A new trusted device was added.", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "old_permission", + "operation_type", + "created_at", + "permission", + "new_repo_permission", + "new_repo_base_role", + "old_repo_permission", + "old_repo_base_role" + ] + }, + { + "action": "trusted_device.register", + "description": "A new trusted device was added.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15956,17 +23875,30 @@ "description": "A trusted device was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15974,14 +23906,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "action", - "request_id", - "user_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -15990,15 +23937,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "created_at", - "user_id", - "operation_type", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action" + "created_at", + "operation_type" ] }, { @@ -16006,13 +23968,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "created_at", - "user_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16020,17 +23999,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "operation_type", - "action", - "_document_id" + "created_at", + "operation_type" ] }, { @@ -16038,17 +24030,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user", - "created_at", - "request_id", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -16056,16 +24061,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16073,54 +24092,93 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_id", - "action", "@timestamp", - "created_at", - "user_agent", - "user", "_document_id", - "request_id" - ] - }, - { - "action": "two_factor_authentication.add_factor", - "description": "A secondary authentication factor was added to a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", - "fields": [ + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "two_factor_authentication.add_factor", + "description": "A secondary authentication factor was added to a user account.", + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, { "action": "two_factor_authentication.disabled", "description": "Two-factor authentication was disabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", "fields": [ - "actor", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor_id", + "user_agent", "created_at", - "operation_type", - "request_id", - "@timestamp", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Disabling two-factor authentication for your personal account" }, @@ -16129,18 +24187,30 @@ "description": "Two-factor authentication was enabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ - "actor", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Configuring two-factor authentication" }, @@ -16149,15 +24219,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user", - "user_id", - "action", "@timestamp", - "request_id", "_document_id", - "user_agent" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16165,16 +24250,29 @@ "description": "Two factor recovery codes were regenerated for a user account.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", + "operation_type", "created_at" ] }, @@ -16183,18 +24281,30 @@ "description": "A secondary authentication factor was removed from a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -16203,15 +24313,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "created_at", - "_document_id", - "action", - "@timestamp" + "operation_type", + "created_at" ] }, { @@ -16220,16 +24345,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "operation_type", "user_agent", - "action", - "request_id", - "actor", - "actor_id" + "created_at", + "operation_type" ] }, { @@ -16237,19 +24375,31 @@ "description": "An email address was added to a user account.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", "operation_type", - "_document_id", - "actor_id", - "actor", "email", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding an email address to your GitHub account" }, @@ -16258,18 +24408,30 @@ "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", - "created_at", - "user", - "@timestamp", - "_document_id", - "request_id", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -16277,15 +24439,28 @@ "description": "Audit log entries were exported.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "action", - "request_id", - "actor", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", "created_at" ] @@ -16295,20 +24470,31 @@ "description": "A user was blocked by another user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_id", - "_document_id", "actor_id", - "@timestamp", - "user_agent", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -16316,18 +24502,30 @@ "description": "A user changed their password.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "actor_id", - "operation_type", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "created_at", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16335,18 +24533,30 @@ "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -16355,17 +24565,30 @@ "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -16374,16 +24597,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "user_agent", - "created_at", - "user", "action", - "operation_type", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16391,16 +24628,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "_document_id", "@timestamp", - "created_at", - "user_agent", - "operation_type", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16408,16 +24659,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "created_at", - "_document_id", - "user_agent", - "user_id", "@timestamp", - "user", + "_document_id", "action", - "request_access_security_header" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16425,41 +24690,65 @@ "description": "A new user account was created.", "docs_reference_links": "N/A", "fields": [ - "email", - "user_id", - "operation_type", "@timestamp", - "request_id", - "user", - "created_at", "_document_id", - "user_agent", - "actor", - "actor_id", "action", - "programmatic_access_type" - ] - }, - { - "action": "user.create_integration_secret", - "description": "A user secret for Codespaces was created.", - "docs_reference_links": "N/A", - "fields": [ "actor", "actor_id", - "user_agent", - "request_id", - "key", - "visibility", - "integration", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", + "user_agent", + "email", + "operation_type", + "created_at" + ] + }, + { + "action": "user.create_integration_secret", + "description": "A user secret for Codespaces was created.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "visibility", + "integration", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -16467,20 +24756,31 @@ "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "user_agent", + "@timestamp", "_document_id", - "operation_type", - "oauth_application_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "@timestamp", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -16488,18 +24788,30 @@ "description": "A user account was destroyed by an asynchronous job.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "request_id", - "user_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16508,19 +24820,30 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "oauth_application_id", + "_document_id", "action", - "user", - "created_at", - "user_agent", - "request_id", "actor", "actor_id", - "operation_type", - "_document_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", + "operation_type" ] }, { @@ -16528,18 +24851,30 @@ "description": "A user deleted his or her account, triggering user.async_delete.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", - "created_at", - "user_agent", "user_id", - "operation_type", - "actor_id", - "action", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16547,18 +24882,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "user_agent", "user_id", - "actor_id", - "action", - "operation_type", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16566,18 +24913,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "operation_type", - "created_at", - "_document_id", - "@timestamp", - "user", - "actor_id", - "action", - "request_access_security_header" + "created_at" ] }, { @@ -16586,17 +24945,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user", "_document_id", "action", - "operation_type", - "user_agent", - "created_at", - "request_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16604,35 +24975,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ] + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] }, { "action": "user.disable_contributors_only", "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16640,17 +25037,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16658,21 +25068,31 @@ "description": "An enterprise managed user claimed an email address.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16680,21 +25100,31 @@ "description": "N/A", "docs_reference_links": "An enterprise managed user unclaimed an email address.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." }, @@ -16703,17 +25133,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16721,17 +25164,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16739,17 +25195,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16757,18 +25226,30 @@ "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "action", - "operation_type", - "request_id", - "created_at", - "_document_id", "@timestamp", - "user", - "org_id", + "_document_id", + "action", "actor", "actor_id", - "user_agent" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16776,16 +25257,29 @@ "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", "user_agent", + "operation_type", "created_at" ] }, @@ -16794,36 +25288,63 @@ "description": "A user requested a password reset.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", "fields": [ - "action", - "_document_id", - "user_agent", - "request_id", - "user", - "operation_type", "@timestamp", - "email", - "created_at", - "user_id", - "request_access_security_header" - ], - "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" - }, - { - "action": "user.grant_github_developer", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "actor_id", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", + "email", + "created_at" + ], + "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" + }, + { + "action": "user.grant_github_developer", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor", - "operation_type", - "request_id" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16831,18 +25352,30 @@ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -16851,19 +25384,31 @@ "description": "A user signed in.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "actor_id", "@timestamp", - "user", - "action", - "operation_type", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "actor", - "passkey_nickname", - "request_access_security_header" + "passkey_nickname" ] }, { @@ -16871,18 +25416,30 @@ "description": "A user signed out.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -16890,19 +25447,30 @@ "description": "A comment made by a user was minimized.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", - "actor_id", "@timestamp", - "created_at", - "operation_type", "_document_id", - "user", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16910,18 +25478,30 @@ "description": "A user signed in from a new device.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16929,14 +25509,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", "_document_id", "action", - "@timestamp", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16944,60 +25540,94 @@ "description": "An ordinary user account was promoted to a site administrator.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "user", - "@timestamp", - "created_at", - "user_agent", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "_document_id", + "token_id", "token_scopes", - "programmatic_access_type", - "request_access_security_header" - ] - }, - { - "action": "user.recreate", - "description": "A user's account was restored.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", "user", - "action", - "actor_id", - "@timestamp", - "_document_id", - "request_id", "user_id", + "user_agent", "created_at", - "actor", + "oauth_application_id", "operation_type" ] }, { - "action": "user.remove_email", - "description": "An email address was removed from a user account.", + "action": "user.recreate", + "description": "A user's account was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "operation_type", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "user.remove_email", + "description": "An email address was removed from a user account.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "email", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "email" ] }, { @@ -17005,20 +25635,32 @@ "description": "A user secret for Codespaces was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "key", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "key", + "integration", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17026,17 +25668,30 @@ "description": "A user account was no longer flagged as a large scale contributor.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -17044,20 +25699,31 @@ "description": "A username was changed.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "request_id", - "actor_id", - "old_login", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "operation_type", "user_agent", - "token_scopes", - "programmatic_access_type" + "old_login", + "created_at", + "operation_type" ] }, { @@ -17065,17 +25731,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "user_agent", - "request_id", - "action", "@timestamp", - "created_at", - "org_id", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -17084,18 +25762,30 @@ "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "action", "created_at", - "actor", - "operation_type", - "actor_id", - "user_id", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam" }, @@ -17104,18 +25794,30 @@ "description": "A user reset their account password.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "@timestamp", - "_document_id", - "actor", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17123,16 +25825,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_id", - "action", "@timestamp", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -17143,16 +25858,28 @@ "fields": [ "@timestamp", "_document_id", - "request_id", - "user_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor_id", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -17161,18 +25888,30 @@ "description": "A user signed in from an unrecognized device.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "created_at", - "actor", - "actor_id", - "@timestamp", - "request_access_security_header" + "created_at" ] }, { @@ -17180,18 +25919,30 @@ "description": "A user signed in from an unrecognized device and location.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "created_at", - "_document_id", - "request_id", - "action", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17199,18 +25950,30 @@ "description": "A user signed in from an unrecognized location.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "action", - "operation_type", - "user_agent", - "user", + "@timestamp", "_document_id", + "action", "actor", - "created_at", "actor_id", - "@timestamp", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17218,22 +25981,33 @@ "description": "Triggered when you clear the status on your profile.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "message", - "user", - "actor_id", "created_at", - "request_id", "limited_availability", - "action", "emoji", - "operation_type", - "user_agent", - "@timestamp", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -17241,23 +26015,33 @@ "description": "Triggered when you set or change the status on your profile.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", "fields": [ - "limited_availability", - "user", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "message", - "user_id", - "created_at", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "limited_availability", + "message", + "created_at", "emoji", - "org", - "actor", - "operation_type", - "token_scopes", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Personalize your profile" }, @@ -17266,21 +26050,31 @@ "description": "A user account was suspended.", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", - "operation_type", - "actor_id", - "user", - "user_agent", - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", - "user_id", + "_document_id", "action", - "token_scopes", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -17288,18 +26082,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", - "actor_id", "@timestamp", - "operation_type", "_document_id", - "user_agent", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17307,18 +26113,30 @@ "description": "A 2FA challenge issued for a user account failed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "_document_id", - "user_agent", - "user", - "actor_id", - "actor", - "user_id", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17328,16 +26146,28 @@ "fields": [ "@timestamp", "_document_id", - "user_id", - "operation_type", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "actor", + "user_id", "user_agent", - "request_id", - "action", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -17345,18 +26175,30 @@ "description": "A user used their 2FA recovery codes.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "user_agent", - "request_id", - "user", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "created_at", - "@timestamp", - "_document_id", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17364,18 +26206,30 @@ "description": "A user downloaded 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -17383,17 +26237,30 @@ "description": "A user printed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", - "user_agent", - "request_id", - "user_id", - "created_at", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17401,18 +26268,30 @@ "description": "A user viewed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_agent", - "actor", - "user_id", - "action", - "created_at", - "user", - "operation_type", "@timestamp", - "request_id", "_document_id", - "request_access_security_header" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17420,17 +26299,30 @@ "description": "A user was prompted for a two-factor authentication code.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", "fields": [ - "user", - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "actor" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" }, @@ -17439,19 +26331,31 @@ "description": "A user was unblocked by another user.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "actor", - "@timestamp", - "user_agent", - "user_id", - "user", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -17460,15 +26364,28 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user_agent", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "request_id", - "actor", - "action", "created_at" ] }, @@ -17477,21 +26394,31 @@ "description": "A user account was unsuspended.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", - "user", "action", - "user_agent", "actor", - "oauth_application_id", - "operation_type", "actor_id", - "created_at", - "@timestamp", - "user_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -17499,21 +26426,33 @@ "description": "A user secret for Codespaces was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17521,18 +26460,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17540,16 +26491,30 @@ "description": "A Dependabot rule was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17559,16 +26524,30 @@ "description": "A Dependabot rule was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17578,18 +26557,31 @@ "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17599,21 +26591,33 @@ "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17621,21 +26625,32 @@ "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -17643,21 +26658,32 @@ "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -17665,16 +26691,30 @@ "description": "A Dependabot rule's conditions, actions, or metadata changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17684,27 +26724,33 @@ "description": "A workflow job was approved.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", - "repo", - "repo_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -17713,23 +26759,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17737,10 +26793,28 @@ "description": "A workflow run was cancelled.", "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17751,20 +26825,9 @@ "run_number", "cancelled_at", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Canceling a workflow run" }, @@ -17773,23 +26836,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17799,10 +26870,28 @@ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17814,19 +26903,9 @@ "conclusion", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -17837,10 +26916,28 @@ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17849,21 +26946,10 @@ "head_branch", "head_sha", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "public_repo", - "programmatic_access_type", "actor_is_bot", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "Understanding GitHub Actions" @@ -17873,23 +26959,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -17898,22 +26996,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -17921,21 +27030,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -17943,25 +27063,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -17969,23 +27097,36 @@ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", "fields": [ - "repo_id", - "repo", - "org_id", - "org", - "business_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "job_name", "runner_labels", "is_hosted_runner", "environment_name", "secrets_passed", - "action", - "_document_id", "operation_type", "created_at", - "@timestamp", "runner_owner_type", "job_workflow_ref", "calling_workflow_refs", @@ -17999,24 +27140,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -18025,10 +27175,28 @@ "description": "A workflow run was re-run.", "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -18038,21 +27206,11 @@ "head_sha", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", "rerun_type", "check_run_id", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "Re-running workflows and jobs" @@ -18062,25 +27220,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.17/organization.json b/src/audit-logs/data/ghes-3.17/organization.json index 57fcd02eb76e..579c2327cfb1 100644 --- a/src/audit-logs/data/ghes-3.17/organization.json +++ b/src/audit-logs/data/ghes-3.17/organization.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,29 +67,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -72,21 +103,32 @@ "description": "Credit was accepted for a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Editing a repository security advisory" }, @@ -95,21 +137,32 @@ "description": "Someone was added to the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -117,21 +170,32 @@ "description": "Credit was declined for a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -140,21 +204,32 @@ "description": "Someone was removed from the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -163,18 +238,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -182,17 +269,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -203,39 +301,62 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" - }, + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -244,19 +365,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -265,18 +398,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -284,18 +430,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -303,20 +461,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -325,20 +494,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -349,17 +529,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -367,15 +559,31 @@ "description": "Existing code scanning alerts appeared in a branch.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -385,15 +593,31 @@ "description": "Code scanning alerts were fixed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -403,15 +627,31 @@ "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_numbers", - "commit_oid", - "ref", - "request_id", - "org_id", - "org", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", - "business" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_numbers", + "commit_oid", + "ref" ], "docs_reference_titles": "About code scanning" }, @@ -420,15 +660,29 @@ "description": "Code scanning alerts were manually dismissed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers", "dismissal_approver_id" ], @@ -439,19 +693,31 @@ "description": "Dismissal of code scanning alerts was approved.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -462,19 +728,31 @@ "description": "Dismissal of code scanning alerts was denied.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -485,19 +763,31 @@ "description": "Dismissal of code scanning alerts was requested.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -508,13 +798,31 @@ "description": "Code scanning alerts were seen for the first time.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -524,15 +832,31 @@ "description": "Code scanning alerts that were previously fixed reappeared.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -542,15 +866,29 @@ "description": "Code scanning alerts that were previously dismissed were reopened.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -560,14 +898,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -577,28 +930,34 @@ "description": "An attempt to create a codespace from a prebuild was made.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "owner", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "user_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_id", + "user_agent", + "name", + "owner", + "pull_request_id", "created_at", "operation_type", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -606,17 +965,30 @@ "description": "Enterprise setting for Codespaces ownership was updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enablement", "organization_names", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -627,25 +999,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -656,22 +1037,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -683,22 +1075,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -707,15 +1110,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -726,15 +1144,28 @@ "description": "Policies were applied to codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -744,20 +1175,30 @@ "description": "Policies were removed from codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -765,19 +1206,30 @@ "description": "Policies were updated for codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -785,17 +1237,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -805,27 +1270,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "org", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "owner", "pull_request_id", "machine_type", - "user_id", - "user", "devcontainer_path", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -833,19 +1307,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -853,18 +1340,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -873,20 +1372,30 @@ "description": "A commit comment was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "repo", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "created_at", - "@timestamp", - "operation_type", + "programmatic_access_type", + "repo", "repo_id", - "actor_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "programmatic_access_type" + "created_at", + "operation_type" ] }, { @@ -894,21 +1403,30 @@ "description": "A commit comment was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "repo_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_id", - "action", - "@timestamp", - "repo", "org_id", - "actor_id", - "created_at", - "user_agent", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -916,21 +1434,33 @@ "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "reason", "plan", - "org_id", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -938,13 +1468,28 @@ "description": "Copilot feature settings were changed at the organization level.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -954,23 +1499,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -978,16 +1530,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -996,40 +1562,59 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "request_access_security_header" - ] - }, - { - "action": "copilot.cfb_seat_assignment_reused", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "copilot.cfb_seat_assignment_reused", "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1039,20 +1624,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -1060,19 +1655,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -1080,21 +1687,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1102,21 +1718,33 @@ "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_value", "new_value", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1124,21 +1752,32 @@ "description": "The excluded paths for GitHub Copilot were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "excluded_paths", "owner_type", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1146,14 +1785,28 @@ "description": "Copilot custom instructions were created for the organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "action", - "_document_id", - "@timestamp", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "custom_instructions" @@ -1164,14 +1817,28 @@ "description": "Copilot custom instructions were updated for the organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "action", - "_document_id", - "@timestamp", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "custom_instructions" @@ -1182,21 +1849,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1204,21 +1881,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1226,21 +1913,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1248,17 +1945,30 @@ "description": "The plan for GitHub Copilot was updated.", "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_plan", "plan", - "business_id", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1270,20 +1980,31 @@ "description": "The plan for GitHub Copilot was scheduled to be downgraded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "current_plan", "scheduled_plan" @@ -1294,21 +2015,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "owner_type", "actor_id", - "user_id", - "owner", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "_document_id", - "@timestamp", + "user_id", + "user_agent", + "owner_type", + "owner", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1316,21 +2048,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "owner_type", "actor_id", - "user_id", - "owner", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "_document_id", - "@timestamp", + "user_id", + "user_agent", + "owner_type", + "owner", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1338,21 +2081,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1362,19 +2114,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1384,21 +2145,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1408,18 +2178,31 @@ "description": "A new custom property definition was created.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -1432,18 +2215,31 @@ "description": "A custom property definition was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -1457,14 +2253,29 @@ "description": "A custom property definition was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "value_type", @@ -1477,8 +2288,7 @@ "old_default_value", "old_value_type", "old_values_editable_by", - "values_editable_by", - "request_access_security_header" + "values_editable_by" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1487,27 +2297,35 @@ "description": "A repository's custom property value was manually set for the first time.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1516,19 +2334,31 @@ "description": "A repository's custom property value was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1537,16 +2367,29 @@ "description": "A repository's custom property value was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "definition_id" @@ -1558,19 +2401,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1579,19 +2433,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1600,19 +2465,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1621,38 +2497,62 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" - }, - { - "action": "dependabot_repository_access.repositories_updated", - "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + }, + { + "action": "dependabot_repository_access.repositories_updated", + "description": "The repositories that Dependabot can access were updated.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1660,19 +2560,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1681,19 +2592,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1701,19 +2623,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1722,19 +2655,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1742,19 +2686,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1763,19 +2718,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1783,19 +2749,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1804,20 +2781,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1825,21 +2812,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", - "repo_id", - "request_id", + "@timestamp", + "_document_id", "action", "actor", - "org_id", - "_document_id", "actor_id", - "operation_type", - "@timestamp", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -1847,20 +2843,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo_id", "@timestamp", - "actor", - "user_agent", - "request_id", - "org", "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "repo", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -1868,22 +2874,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "org_id", - "actor", - "org", - "action", "operation_type", - "@timestamp", - "request_id", "title", - "_document_id", - "created_at", - "repo", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -1891,21 +2906,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "team", - "created_at", - "user_id", "@timestamp", - "number", - "org", - "title", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", "user_agent", - "operation_type", - "_document_id" + "team", + "created_at", + "number", + "title", + "operation_type" ] }, { @@ -1913,18 +2940,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user_id", - "actor", "number", - "user", - "created_at", - "request_id", - "_document_id" + "created_at" ] }, { @@ -1932,18 +2972,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "action", - "_document_id", - "request_id", - "org", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org_id", "user_agent", - "actor", + "operation_type", "number", "team", "created_at" @@ -1954,21 +3005,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "_document_id", - "title", - "user", - "user_agent", - "org", - "operation_type", - "actor_id", "@timestamp", - "actor", - "team", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", + "title", + "operation_type", + "team", "number" ] }, @@ -1977,17 +3039,31 @@ "description": "A global announcement banner was created for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -1998,16 +3074,30 @@ "description": "A global announcement banner was removed from the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2018,18 +3108,32 @@ "description": "A global announcement banner was updated for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", "old_message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2040,17 +3144,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was created.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", - "operation_type", "@timestamp", "_document_id", - "org_id", "action", - "request_id", - "org", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -2059,17 +3176,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was deleted.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", + "@timestamp", "_document_id", "action", - "@timestamp", - "actor_id", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -2078,22 +3208,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2102,22 +3241,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2125,28 +3274,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2155,27 +3310,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -2184,25 +3347,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2211,26 +3382,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2239,21 +3417,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -2262,22 +3452,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2286,25 +3486,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2313,22 +3522,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -2337,21 +3558,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -2362,19 +3593,30 @@ "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2383,20 +3625,30 @@ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2405,19 +3657,30 @@ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2426,23 +3689,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2450,18 +3722,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -2472,20 +3754,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2495,25 +3787,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "name", - "events", - "active", - "active_was", - "hook_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "events", + "active", + "active_was", + "hook_id", + "operation_type" ] }, { @@ -2521,25 +3823,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -2547,26 +3858,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -2575,25 +3895,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -2601,26 +3930,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -2628,21 +3966,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -2651,19 +4000,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -2671,21 +4033,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -2694,19 +4067,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -2717,20 +4104,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2740,24 +4139,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2768,23 +4178,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2795,21 +4217,33 @@ "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", "operation_type", - "@timestamp", "integration", - "action", - "user_agent", "reason", - "_document_id", - "org", - "org_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -2820,20 +4254,32 @@ "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ "@timestamp", - "actor_id", - "org", "_document_id", - "requester", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "requester", "created_at", "url", - "org_id", - "request_id", "operation_type", - "actor", "integration", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -2843,20 +4289,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2866,19 +4325,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -2887,20 +4360,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -2910,20 +4396,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -2932,20 +4431,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -2954,20 +4466,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -2975,19 +4499,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2996,19 +4533,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -3017,17 +4567,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -3040,21 +4603,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -3068,17 +4644,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -3090,19 +4679,30 @@ "description": "An IP allow list was disabled.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "actor", - "request_id", - "org", - "user_agent", + "@timestamp", "_document_id", - "user_id", + "action", + "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "@timestamp", - "user" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3110,19 +4710,30 @@ "description": "An IP allow list was disabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3130,20 +4741,29 @@ "description": "An IP allow list was enabled.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "user_id", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "business_id", - "_document_id", - "action", - "@timestamp", + "user_id", "user_agent", - "actor_id", "operation_type", - "org", "created_at" ] }, @@ -3152,19 +4772,30 @@ "description": "An IP allow list was enabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3172,24 +4803,32 @@ "description": "An IP address was added to an IP allow list.", "docs_reference_links": "N/A", "fields": [ - "active", - "org", - "ip_allow_list_entry", "@timestamp", "_document_id", - "operation_type", - "created_at", - "user_agent", "action", - "request_id", + "actor", "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "business", - "actor", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", + "ip_allow_list_entry", + "operation_type", + "created_at" ] }, { @@ -3197,24 +4836,32 @@ "description": "An IP address was deleted from an IP allow list.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "ip_allow_list_entry", - "org", - "operation_type", - "created_at", - "active", "action", - "@timestamp", + "actor", + "actor_id", "business", "business_id", - "user_agent", + "hashed_token", + "org", "org_id", - "actor", - "actor_id", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ip_allow_list_entry", + "operation_type", + "created_at", + "active" ] }, { @@ -3222,19 +4869,32 @@ "description": "An IP address or its description was changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "actor_id", "ip_allow_list_entry", - "active", - "org_id", - "@timestamp" + "active" ] }, { @@ -3242,22 +4902,31 @@ "description": "A comment on an issue was deleted from the repository.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "org", - "repo", - "actor_id", "@timestamp", - "created_at", "_document_id", "action", - "operation_type", - "user_agent", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "oauth_application_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -3265,24 +4934,30 @@ "description": "A comment on an issue was pinned to a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3293,19 +4968,29 @@ "description": "A comment on an issue was unpinned from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3316,44 +5001,63 @@ "description": "A comment on an issue (other than the initial one) changed.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", + "@timestamp", + "_document_id", "action", - "repo_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", + "oauth_application_id" + ] + }, + { + "action": "issue.destroy", + "description": "An issue was deleted from the repository.", + "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", + "fields": [ "@timestamp", - "user_agent", - "request_id", "_document_id", - "actor_id", + "action", "actor", - "oauth_application_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" - ] - }, - { - "action": "issue.destroy", - "description": "An issue was deleted from the repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", - "fields": [ "user", - "actor_id", - "created_at", - "title", - "@timestamp", - "_document_id", - "request_id", - "actor", "user_id", - "action", - "operation_type", "user_agent", - "repo", - "token_scopes", - "programmatic_access_type" + "created_at", + "title", + "operation_type" ], "docs_reference_titles": "Deleting an issue" }, @@ -3362,23 +5066,33 @@ "description": "An issue was pinned to a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ + "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", "action", "actor", - "operation_type", - "owner_type", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "number", - "repo", - "event", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type", + "owner_type", + "number", + "event" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -3387,22 +5101,32 @@ "description": "An issue was transferred to another repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "owner_type", - "actor_id", "number", - "repo", "operation_type", - "_document_id", - "repo_id", - "action", - "request_id", - "created_at", - "actor", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Transferring an issue to another repository" }, @@ -3411,24 +5135,33 @@ "description": "An issue was unpinned from a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ - "event", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", - "action", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "operation_type", - "_document_id", - "number", - "owner_type", - "@timestamp", + "token_id", + "token_scopes", "user", "user_id", - "token_scopes", - "request_access_security_header" + "user_agent", + "event", + "created_at", + "operation_type", + "number", + "owner_type" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -3437,19 +5170,30 @@ "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user_agent", - "action", "@timestamp", - "operation_type", - "request_id", - "actor_id", - "user_id", - "created_at", "_document_id", + "action", "actor", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "org_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3458,18 +5202,29 @@ "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -3479,19 +5234,30 @@ "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user", - "request_id", - "actor", - "business_id", - "action", - "operation_type", - "user_agent", - "created_at", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor_id" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3500,18 +5266,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3519,21 +5297,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -3541,21 +5332,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", "marketplace_listing", - "@timestamp", "integration", - "org_id", - "action", - "org", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -3563,22 +5367,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -3586,19 +5403,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -3608,22 +5438,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -3631,22 +5474,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -3654,20 +5510,30 @@ "description": "The ability for members to publish GitHub Pages sites was disabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3676,20 +5542,30 @@ "description": "The ability for members to publish GitHub Pages sites was enabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3698,21 +5574,30 @@ "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3721,22 +5606,30 @@ "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3745,21 +5638,30 @@ "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "business", - "business_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3768,22 +5670,30 @@ "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3792,19 +5702,30 @@ "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "operation_type", "user_agent", - "actor", - "actor_id", - "business_id", - "@timestamp", - "created_at", - "action" + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3813,18 +5734,29 @@ "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "request_id", - "org", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "actor", "operation_type", - "org_id", - "action", - "@timestamp", "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -3834,21 +5766,30 @@ "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "action", - "org_id", - "user_id", - "business", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business_id", + "user_id", + "user_agent", "created_at", - "actor", - "org", - "operation_type", - "user_agent" + "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3859,16 +5800,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -3877,21 +5829,30 @@ "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "created_at", - "user_id", "business_id", - "user", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "org_id", - "@timestamp" + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -3900,19 +5861,30 @@ "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ - "request_id", - "created_at", - "_document_id", - "user_agent", - "user", - "user_id", - "business", - "business_id", - "operation_type", "@timestamp", + "_document_id", "action", "actor", - "actor_id" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -3921,19 +5893,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3941,21 +5925,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3965,16 +5958,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3984,18 +5990,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4005,14 +6024,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -4020,19 +6055,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -4040,18 +6086,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -4059,23 +6117,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -4083,16 +6149,30 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "org_id", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4100,24 +6180,32 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", - "repo_id", "operation_type", - "@timestamp", - "user_agent", "created_at", - "org", - "action", - "_document_id", - "repo", - "actor", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4125,15 +6213,28 @@ "description": "A network configuration for a hosted compute service was created.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -4151,15 +6252,28 @@ "description": "A network configuration for a hosted compute service was deleted.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -4172,15 +6286,28 @@ "description": "A network configuration for a hosted compute service was updated.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -4197,20 +6324,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4219,20 +6358,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4241,20 +6392,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4263,20 +6426,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4285,19 +6460,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4306,20 +6494,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4328,20 +6528,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4350,19 +6562,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4371,17 +6596,28 @@ "description": "An invitation sent to an organization to join an enterprise was accepted.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4392,20 +6628,30 @@ "description": "A billing manager was added to an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "org", - "user_id", "action", - "created_at", - "org_id", - "user", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" }, @@ -4414,21 +6660,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -4437,24 +6693,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4462,21 +6728,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -4484,20 +6760,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -4505,22 +6791,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -4528,20 +6822,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -4549,22 +6853,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -4572,21 +6884,31 @@ "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "new_policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "new_policy", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -4596,19 +6918,30 @@ "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -4617,19 +6950,30 @@ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -4639,15 +6983,28 @@ "description": "Third-party application access for outside collaborators was disabled for the organization.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4658,15 +7015,28 @@ "description": "Third-party application access for outside collaborators was enabled for the organization.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4677,15 +7047,28 @@ "description": "The organization was archived.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4695,17 +7078,30 @@ "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", "fields": [ - "org_id", - "operation_type", "@timestamp", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" }, @@ -4714,21 +7110,32 @@ "description": "An export of the organization's Git events was created.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "start", "end", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" }, @@ -4737,16 +7144,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_agent", - "action", "@timestamp", - "actor_id", - "org_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -4755,18 +7175,31 @@ "description": "An organization owner blocked a user from accessing the organization's repositories.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", "fields": [ - "actor", - "user_agent", - "org_id", - "created_at", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "blocked_user", + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" }, @@ -4774,20 +7207,31 @@ "action": "org.cancel_business_invitation", "description": "An invitation for an organization to join an enterprise was revoked", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", - "fields": [ - "user_agent", - "request_id", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "initiated_from" ], "docs_reference_titles": "Adding organizations to your enterprise" @@ -4797,22 +7241,33 @@ "description": "An invitation sent to a user to join an organization was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "email", - "@timestamp", - "actor", - "action", "operation_type", - "user_agent", - "org", "invitation_id", - "_document_id", "created_at", - "invitee_email", - "token_scopes", - "programmatic_access_type" + "invitee_email" ] }, { @@ -4820,19 +7275,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -4840,23 +7306,31 @@ "description": "Autofix for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4864,21 +7338,31 @@ "description": "Autofix for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4886,23 +7370,31 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4910,23 +7402,31 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4934,21 +7434,30 @@ "description": "Code scanning using the default setup was disabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -4957,21 +7466,30 @@ "description": "Code scanning using the default setup was enabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -4980,20 +7498,31 @@ "description": "Access to use Codespaces on internal and private repositories was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "enablement", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "enablement", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization" }, @@ -5002,21 +7531,31 @@ "description": "Ownership and payment for codespaces was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "owner_type", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" }, @@ -5025,16 +7564,29 @@ "description": "A team has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5044,16 +7596,29 @@ "description": "A team has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5063,19 +7628,30 @@ "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -5084,17 +7660,30 @@ "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -5103,21 +7692,30 @@ "description": "A user has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -5125,21 +7723,30 @@ "description": "A user has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -5147,16 +7754,29 @@ "description": "The interaction limit for collaborators only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "request_id", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" @@ -5166,17 +7786,30 @@ "description": "The interaction limit for prior contributors only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "operation_type", "@timestamp", - "created_at", - "user_agent", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", - "actor", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5185,17 +7818,30 @@ "description": "The interaction limit for existing users only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", "_document_id", - "operation_type", - "actor_id", - "org_id", "action", - "created_at", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5205,16 +7851,29 @@ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ "@timestamp", - "created_at", "_document_id", - "actor_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "action", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5223,17 +7882,30 @@ "description": "The interaction limit for prior contributors only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "operation_type", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5242,17 +7914,30 @@ "description": "The interaction limit for existing users only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "actor_id", - "request_id", + "@timestamp", + "_document_id", "action", - "created_at", - "user_agent", "actor", - "_document_id", - "org_id", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5261,22 +7946,30 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" }, @@ -5285,17 +7978,28 @@ "description": "An invitation for an organization to join an enterprise was confirmed.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5306,15 +8010,28 @@ "description": "Server statistics were exported for the organization.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5325,18 +8042,30 @@ "description": "An organization was created.", "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", "fields": [ - "request_id", - "org", - "actor_id", - "actor", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "org_id", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" }, @@ -5345,20 +8074,31 @@ "description": "A GitHub Actions secret was created for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5367,20 +8107,32 @@ "description": "A GitHub Actions variable was created for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5389,21 +8141,33 @@ "description": "A Codespaces or Dependabot secret was created for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -5411,21 +8175,30 @@ "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor_id", - "org_id", - "business", - "action", "@timestamp", - "org", "_document_id", - "business_id", + "action", "actor", - "token_scopes", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "actor_is_bot", "oauth_credential_type", "managed_oauth_access_id", @@ -5441,24 +8214,32 @@ "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", "fields": [ - "user_agent", - "actor", "@timestamp", - "created_at", - "org_id", - "business_id", - "operation_type", - "request_id", "_document_id", "action", + "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", - "token_scopes", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot", "oauth_credential_type", - "request_access_security_header", "managed_oauth_access_id", "managed_token_id", "managed_oauth_scopes", @@ -5472,21 +8253,32 @@ "description": "An owner revoked authorized credentials.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "oauth_application_id", - "org_id", "operation_type", - "action", - "business", - "request_id", "created_at", - "business_id", - "actor_id", - "_document_id", - "user_agent", "oauth_credential_type", "managed_oauth_access_id", "managed_token_id", @@ -5501,18 +8293,30 @@ "description": "An organization was deleted by a user or staff.", "docs_reference_links": "N/A", "fields": [ - "user_agent", "@timestamp", "_document_id", - "created_at", - "actor", - "org_id", - "org", "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5520,20 +8324,30 @@ "description": "Team creation was limited to owners.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "actor", "@timestamp", "_document_id", - "user", - "user_id", "action", - "created_at", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -5542,16 +8356,29 @@ "description": "Third-party application access restrictions for an organization were disabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "org_id", - "action", - "_document_id", - "request_id", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" @@ -5561,19 +8388,30 @@ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -5582,14 +8420,31 @@ "description": "SAML single sign-on was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sso_url", "issuer", - "action", - "@timestamp", - "_document_id", "created_at", - "org", "operation_type" ] }, @@ -5598,21 +8453,30 @@ "description": "Display of IP addresses within audit log events for the organization was disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" }, @@ -5621,17 +8485,30 @@ "description": "A two-factor authentication requirement was disabled for the organization.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "org_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "_document_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5639,19 +8516,30 @@ "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "user", - "action", - "operation_type", "@timestamp", "_document_id", - "created_at", - "user_agent", - "org", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5659,19 +8547,30 @@ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "user", - "action", - "actor_id", - "org_id" + "created_at" ] }, { @@ -5679,19 +8578,30 @@ "description": "Team creation by members was allowed.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "org_id", - "user", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -5700,17 +8610,30 @@ "description": "Third-party application access restrictions for an organization were enabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "operation_type", - "org", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" }, @@ -5719,19 +8642,30 @@ "description": "An organization owner allowed users with read access to create discussions in an organization", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -5740,19 +8674,32 @@ "description": "SAML single sign-on was enabled for the organization.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", - "sso_url", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "@timestamp", - "issuer", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "sso_url", + "created_at", + "issuer" ], "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" }, @@ -5761,21 +8708,30 @@ "description": "Display of IP addresses within audit log events for the organization was enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" }, @@ -5784,17 +8740,30 @@ "description": "Two-factor authentication is now required for the organization.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "actor_id", - "action", - "_document_id", - "org", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" }, @@ -5803,17 +8772,30 @@ "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "org_id", - "manager", "@timestamp", - "request_id", - "actor", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "manager", + "operation_type", "created_at" ] }, @@ -5822,18 +8804,31 @@ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", "docs_reference_links": "N/A", "fields": [ - "org_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "actor", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "manager", "operation_type", - "created_at", - "_document_id" + "created_at" ] }, { @@ -5841,23 +8836,32 @@ "description": "A new user was invited to join an organization.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", "fields": [ - "org", - "user_id", - "invitation_id", - "org_id", - "user", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", - "created_at", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "invitee_email", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitation_id", + "operation_type", + "created_at", + "invitee_email" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" }, @@ -5866,17 +8870,28 @@ "description": "An organization was invited to join an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5886,19 +8901,30 @@ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -5906,19 +8932,30 @@ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "org", - "org_id", - "user_agent", - "actor_id", - "user_id", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5926,19 +8963,31 @@ "description": "Access to an organization was granted for an OAuth App.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "request_id", "actor_id", - "operation_type", - "org_id", - "_document_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" @@ -5948,20 +8997,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -5970,18 +9030,31 @@ "description": "Access was disabled for an OAuth App that was previously approved.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", "fields": [ - "request_id", - "url", - "created_at", - "org_id", - "action", "@timestamp", "_document_id", - "user_agent", - "org", - "operation_type", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", + "operation_type", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" @@ -5991,19 +9064,31 @@ "description": "An organization member requested that an owner grant an OAuth App access to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", + "@timestamp", "_document_id", - "request_id", - "url", - "org_id", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "url", "oauth_application_name" ] }, @@ -6012,20 +9097,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "url", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -6035,16 +9131,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "org_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type", - "_document_id", - "org" + "created_at", + "operation_type" ] }, { @@ -6052,20 +9161,31 @@ "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "reason", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "reason", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -6074,20 +9194,30 @@ "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -6096,19 +9226,30 @@ "description": "An organization owner downloaded the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6117,19 +9258,30 @@ "description": "An organization owner generated the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6138,19 +9290,30 @@ "description": "An organization owner printed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6159,19 +9322,30 @@ "description": "An organization owner viewed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6180,19 +9354,31 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", "fields": [ - "actor", - "operation_type", "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "actor_is_bot", - "request_access_security_header" + "operation_type", + "created_at", + "actor_is_bot" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -6201,20 +9387,31 @@ "description": "A GitHub Actions secret was removed from an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -6223,21 +9420,31 @@ "description": "A GitHub Actions variable was removed from an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -6246,18 +9453,29 @@ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "user_id", - "user_agent", - "org_id", - "user", - "action", - "_document_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" @@ -6267,22 +9485,32 @@ "description": "A Codespaces or Dependabot secret was removed from an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -6290,21 +9518,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6312,21 +9549,30 @@ "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ - "org", - "user", - "org_id", - "created_at", - "request_id", "@timestamp", - "action", - "operation_type", - "user_agent", "_document_id", + "action", "actor", "actor_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6334,21 +9580,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -6356,18 +9612,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", "fields": [ - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "actor", - "action", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -6376,19 +9644,31 @@ "description": "An organization was renamed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "_document_id", "@timestamp", - "org", + "_document_id", "action", "actor", - "old_login", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_login", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -6396,14 +9676,28 @@ "description": "Triggered when a required workflow is created.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6414,14 +9708,28 @@ "description": "Triggered when a required workflow is deleted.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -6432,14 +9740,28 @@ "description": "Triggered when a required workflow is updated.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6450,20 +9772,30 @@ "description": "An organization member was restored.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", "fields": [ - "user", - "actor", - "user_id", + "@timestamp", "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "actor_id", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" }, @@ -6472,18 +9804,29 @@ "description": "A member's linked identity was revoked.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", "user_id", - "@timestamp", - "action", - "actor_id", "user_agent", - "_document_id", - "request_id", + "operation_type", "created_at" ], "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" @@ -6493,19 +9836,30 @@ "description": "A member's SAML session was revoked.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", "fields": [ - "actor_id", - "created_at", - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" }, @@ -6514,21 +9868,33 @@ "description": "A self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" @@ -6538,21 +9904,31 @@ "description": "A self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6561,20 +9937,31 @@ "description": "A self-hosted runner group was renamed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6583,23 +9970,33 @@ "description": "The REST API was used to remove a self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -6608,23 +10005,31 @@ "description": "A self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6633,19 +10038,32 @@ "description": "A runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -6654,25 +10072,36 @@ "description": "The configuration of a self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6681,21 +10110,32 @@ "description": "The visibility of a self-hosted runner group was updated via the REST API.", "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", - "visibility", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" }, @@ -6704,21 +10144,30 @@ "description": "Automatic partner validation checks have been disabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -6728,21 +10177,30 @@ "description": "Automatic partner validation checks have been enabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -6752,20 +10210,30 @@ "description": "A custom pattern was created for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6774,22 +10242,30 @@ "description": "A custom pattern was removed from secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6798,21 +10274,30 @@ "description": "A custom pattern was published for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6821,21 +10306,30 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6844,22 +10338,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6868,21 +10370,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6891,22 +10402,30 @@ "description": "Generic secrets have been disabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -6914,22 +10433,30 @@ "description": "Generic secrets have been enabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -6937,21 +10464,30 @@ "description": "Secret scanning for non-provider patterns was disabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -6961,21 +10497,30 @@ "description": "Secret scanning for non-provider patterns was enabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -6985,19 +10530,30 @@ "description": "A role or team was added to the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7007,21 +10563,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7031,21 +10596,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7055,19 +10629,30 @@ "description": "A role or team was removed from the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7077,22 +10662,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7101,22 +10694,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7125,22 +10726,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7149,21 +10758,30 @@ "description": "Push protection for secret scanning was disabled.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7172,21 +10790,30 @@ "description": "Push protection for secret scanning was enabled.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7195,22 +10822,30 @@ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7219,22 +10854,30 @@ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7243,26 +10886,35 @@ "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -7271,26 +10923,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7298,28 +10958,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org", - "org_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7327,26 +10995,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7354,15 +11030,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -7371,15 +11064,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -7388,7 +11098,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -7403,20 +11134,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -7425,16 +11167,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -7445,18 +11200,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -7465,17 +11233,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", "_document_id", - "org_id", - "operation_type", + "action", "actor", "actor_id", - "@timestamp", - "request_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", - "action" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7483,18 +11264,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -7503,18 +11296,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "policy", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -7523,18 +11329,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -7543,22 +11361,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", "actor_id", - "org_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issuer", - "business", "operation_type", "created_at", - "request_id", - "business_id", - "_document_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7566,21 +11394,32 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Adding organizations to your enterprise" }, @@ -7589,19 +11428,30 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -7612,15 +11462,28 @@ "description": "The organization was unarchived.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7630,19 +11493,32 @@ "description": "A user was unblocked from an organization.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", "fields": [ - "oauth_application_id", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", - "@timestamp", - "request_id", - "created_at", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "blocked_user", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" }, @@ -7651,20 +11527,32 @@ "description": "A GitHub Actions secret was updated for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "created_at", "key", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -7673,23 +11561,34 @@ "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "updated_allowed_types", "old_policy", - "updated_access_policy", - "programmatic_access_type", - "request_access_security_header" + "updated_access_policy" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" }, @@ -7698,20 +11597,32 @@ "description": "A GitHub Actions variable was updated for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -7720,20 +11631,32 @@ "description": "The default repository permission level for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", + "created_at", "permission", - "actor_id", - "old_permission", - "_document_id", - "programmatic_access_type" + "old_permission" ] }, { @@ -7741,22 +11664,33 @@ "description": "A Codespaces or Dependabot secret was updated for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -7765,20 +11699,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -7786,17 +11731,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -7806,20 +11764,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -7828,17 +11797,30 @@ "description": "The name of the default branch was changed for new repositories in the organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" }, @@ -7847,17 +11829,30 @@ "description": "The repository self-hosted runners policy was updated", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_repo_runners_policy", "new_repo_runners_policy", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -7868,19 +11863,32 @@ "description": "An organization's SAML provider settings were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "sso_url", - "actor_id", - "operation_type", "@timestamp", - "issuer", - "org", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "operation_type", + "issuer", + "created_at" ] }, { @@ -7888,18 +11896,30 @@ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", "fields": [ - "request_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "_document_id", - "org", - "action", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" }, @@ -7908,18 +11928,30 @@ "description": "A default label was created for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", "fields": [ - "request_id", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", - "_document_id", - "action", - "created_at", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" }, @@ -7928,17 +11960,30 @@ "description": "A default label was deleted for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", "fields": [ - "operation_type", - "request_id", - "actor", "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" }, @@ -7947,17 +11992,30 @@ "description": "A default label was edited for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", "fields": [ - "org", - "created_at", "@timestamp", - "actor", + "_document_id", "action", - "user_agent", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" }, @@ -7966,20 +12024,33 @@ "description": "A domain was approved for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "org_id", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" }, @@ -7988,16 +12059,31 @@ "description": "A domain was added to an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "created_at", + "@timestamp", "_document_id", - "domain_name", "action", - "request_id", + "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "domain_name", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8006,14 +12092,29 @@ "description": "A domain was removed from an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", "fields": [ - "action", - "domain_name", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "domain_name", "operation_type", "created_at" ], @@ -8024,16 +12125,31 @@ "description": "A domain was verified for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "operation_type", - "domain_name", "@timestamp", - "user_agent", - "request_id", - "actor", - "action", - "created_at", "_document_id", - "actor_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "domain_name", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8042,16 +12158,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -8061,17 +12190,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -8081,16 +12221,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -8100,20 +12253,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -8121,19 +12284,30 @@ "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor", - "business_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", "user_agent", - "_document_id", "created_at", - "operation_type", - "request_id", - "business" + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -8142,19 +12316,30 @@ "description": "Organization projects were disabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "operation_type", - "@timestamp", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -8163,18 +12348,29 @@ "description": "Organization projects were enabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor_id", - "org_id", - "created_at", - "user_id", - "org", "@timestamp", "_document_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", + "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" @@ -8184,23 +12380,33 @@ "description": "An organization role was assigned to a user or team.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About custom organization roles" }, @@ -8209,25 +12415,32 @@ "description": "A custom organization role was created in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8239,25 +12452,32 @@ "description": "A custom organization role was deleted in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8268,19 +12488,30 @@ "description": "A user or team was unassigned an organization role.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type" ], @@ -8291,26 +12522,33 @@ "description": "A custom organization role was edited in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", "old_role_permissions", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -8323,22 +12561,33 @@ "description": "An organization's default project base role was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_project_base_role", - "new_project_base_role", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_project_base_role", + "new_project_base_role", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8346,20 +12595,31 @@ "description": "An entire package was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" @@ -8369,23 +12629,34 @@ "description": "A package was published or republished to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "ecosystem", "version_count", "is_republished", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -8394,21 +12665,32 @@ "description": "A specific package version was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "version", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "ecosystem", "actor_is_bot" ], @@ -8419,21 +12701,34 @@ "description": "A specific package version was published or republished to a package.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "ecosystem", "package", "version", - "actor_id", - "user_agent", "is_republished", - "actor", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -8442,20 +12737,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -8464,17 +12773,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8485,20 +12809,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -8507,18 +12845,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8526,16 +12876,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8543,18 +12907,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8562,18 +12938,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8584,22 +12973,31 @@ "description": "The configured restriction for access to resources via personal access tokens was disabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8607,22 +13005,31 @@ "description": "The configured restriction for access to resources via personal access tokens was enabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8630,18 +13037,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8652,18 +13072,28 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -8674,18 +13104,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -8696,23 +13136,34 @@ "description": "A personal access token expiration limit was set.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "token_expiration", "old_token_expiration", "exempt_administrators", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8720,21 +13171,32 @@ "description": "A personal access token expiration limit was unset.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "programmatic_access_type", - "old_token_expiration", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_token_expiration", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8742,17 +13204,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8763,18 +13238,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", "user_programmatic_access_id", "user_programmatic_access_name", - "user", - "user_id", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8786,17 +13274,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8808,20 +13309,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was created.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -8833,20 +13343,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -8858,20 +13377,29 @@ "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -8883,20 +13411,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -8908,15 +13445,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8926,17 +13478,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -8946,15 +13509,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8964,19 +13542,30 @@ "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "action", - "operation_type", "@timestamp", - "business_id", + "_document_id", + "action", + "actor", "actor_id", - "user", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8984,23 +13573,30 @@ "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "created_at", - "actor_id", + "@timestamp", "_document_id", - "actor", - "user", - "repo", "action", - "user_agent", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", - "programmatic_access_type", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -9008,23 +13604,30 @@ "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_id", - "operation_type", + "@timestamp", "_document_id", "action", - "@timestamp", - "repo", - "org", - "business", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org_id", - "created_at", - "business_id" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9032,17 +13635,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9052,17 +13666,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9072,17 +13697,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9092,17 +13728,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9112,17 +13759,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -9132,17 +13792,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9150,25 +13823,36 @@ "description": "A project's base role was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_project_base_role", "new_project_base_role", "project_number", "public_project", - "business", "project_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9176,20 +13860,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -9199,25 +13894,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "collaborator_type", - "org", - "org_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -9225,20 +13932,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9246,25 +13965,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9272,17 +14003,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -9290,17 +14034,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -9308,18 +14065,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -9328,18 +14097,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -9348,19 +14129,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -9368,17 +14160,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -9390,22 +14195,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -9413,19 +14227,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "operation_type", - "actor", - "action", - "created_at", - "actor_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -9433,17 +14258,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9451,18 +14289,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -9470,20 +14321,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9491,18 +14352,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -9511,18 +14384,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -9531,16 +14416,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -9552,21 +14450,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -9574,22 +14484,32 @@ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", "fields": [ - "repo", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "name", "created_at", - "_document_id", "operation_type", - "actor", - "repo_id", - "org", - "request_id", - "actor_id", - "oauth_application_id", - "@timestamp", - "programmatic_access_type" + "oauth_application_id" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" }, @@ -9598,29 +14518,34 @@ "description": "A protected branch allowance was given to a specific user, team or integration.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", - "actor", - "actor_id", "name", "authorized_actors", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -9628,24 +14553,32 @@ "description": "Branch protection was enabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "repo_id", - "user_id", "@timestamp", - "user_agent", - "repo", - "name", - "org_id", - "user", "_document_id", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", "created_at", "authorized_actor_names", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -9656,21 +14589,31 @@ "description": "Branch protection was disabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "repo", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", - "request_id", - "repo_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "name", + "operation_type", "created_at", - "_document_id", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -9681,22 +14624,32 @@ "description": "Enforcement of dismissing stale pull requests was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "dismiss_stale_reviews_on_push", - "org_id", - "action", - "created_at", - "request_id", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismiss_stale_reviews_on_push", + "created_at", "operation_type", - "actor", - "repo", - "org", - "name", - "programmatic_access_type" + "name" ] }, { @@ -9704,24 +14657,34 @@ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "authorized_actors_only", "authorized_actors", "created_at", - "user_agent", "name", - "_document_id", - "org_id", - "request_id", - "@timestamp", - "actor_id", - "org", - "action", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -9729,30 +14692,37 @@ "description": "A branch protection requirement was overridden by a repository administrator.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "actor", "reasons", - "@timestamp", "before", "after", - "actor_id", - "repo", "operation_type", - "user_agent", "branch", "overridden_codes", - "org", - "org_id", - "action", - "_document_id", - "request_id", "referrer", - "business", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "rule_suite_id" ] @@ -9762,28 +14732,36 @@ "description": "A branch update attempt was rejected.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "request_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "branch", "before", "overridden_codes", "after", - "action", "reasons", - "actor_id", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "actor_is_bot", "rule_suite_id" @@ -9794,23 +14772,32 @@ "description": "Branch protection was enforced for repository administrators.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "admin_enforced", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "name", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "action", "repo_id", - "org_id", - "_document_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "admin_enforced", + "operation_type", + "name", + "created_at" ] }, { @@ -9818,22 +14805,32 @@ "description": "Branch deletion was enabled or disabled for a protected branch.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "operation_type", - "request_id", - "repo", - "@timestamp", - "org_id", - "org", - "action", "allow_deletions_enforcement_level", - "_document_id", - "created_at", - "actor_id", - "user_agent", - "actor", - "repo_id", - "request_access_security_header" + "created_at" ] }, { @@ -9841,23 +14838,32 @@ "description": "Force pushes were enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "actor_id", - "name", + "@timestamp", "_document_id", + "action", "actor", - "repo", - "operation_type", - "request_id", - "allow_force_pushes_enforcement_level", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_force_pushes_enforcement_level", + "created_at" ] }, { @@ -9865,24 +14871,33 @@ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "ignore_approvals_from_contributors", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -9891,22 +14906,32 @@ "description": "Required linear commit history was enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "operation_type", "actor", - "linear_history_requirement_enforcement_level", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "linear_history_requirement_enforcement_level", "name", - "org_id", - "repo_id", - "org", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ] }, { @@ -9914,24 +14939,33 @@ "description": "Fork syncing was enabled or disabled for a read-only branch", "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "lock_allows_fetch_and_merge", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -9940,27 +14974,34 @@ "description": "The enforcement of a branch lock was updated.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "enforcement_level", "lock_branch_enforcement_level", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -9969,18 +15010,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9991,24 +15045,33 @@ "description": "A branch name pattern was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "old_name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "old_name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -10016,25 +15079,32 @@ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", "docs_reference_links": "N/A", "fields": [ - "name", - "org_id", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "@timestamp", + "business", "business_id", - "request_id", - "pull_request_reviews_enforcement_level", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "business", - "user_agent", - "created_at", "repo_id", - "operation_type", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "pull_request_reviews_enforcement_level", + "created_at", + "operation_type" ] }, { @@ -10042,22 +15112,32 @@ "description": "Enforcement of required code owner review was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "created_at", - "require_code_owner_review", - "operation_type", - "name", - "user_agent", - "action", "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "request_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "require_code_owner_review", + "operation_type", + "name" ] }, { @@ -10065,22 +15145,33 @@ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "require_last_push_approval", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" }, @@ -10089,22 +15180,32 @@ "description": "Enforcement of the required number of approvals before merging was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "required_approving_review_count", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "required_approving_review_count", "created_at", - "actor", "operation_type", - "user_agent", - "name", - "org_id", - "action", - "actor_id", - "_document_id", - "org", - "@timestamp", - "programmatic_access_type" + "name" ] }, { @@ -10112,25 +15213,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "user_agent", "@timestamp", "_document_id", - "name", - "repo", "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "business", - "actor_id", - "operation_type", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "required_status_checks_enforcement_level", - "org", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "required_status_checks_enforcement_level" ] }, { @@ -10138,22 +15246,32 @@ "description": "Enforcement of required commit signing was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "name", "@timestamp", - "created_at", "_document_id", - "request_id", - "repo_id", - "org", - "org_id", "action", "actor", "actor_id", - "signature_requirement_enforcement_level", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "programmatic_access_type" + "operation_type", + "name", + "created_at", + "signature_requirement_enforcement_level" ] }, { @@ -10161,22 +15279,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "created_at", - "repo_id", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "name", - "actor", - "repo", "operation_type", - "action", - "strict_required_status_checks_policy", - "programmatic_access_type" + "strict_required_status_checks_policy" ] }, { @@ -10184,23 +15312,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -10209,24 +15348,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -10235,20 +15385,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10257,21 +15421,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -10281,22 +15458,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10305,25 +15494,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10332,23 +15531,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", "key", "fingerprint", - "actor_id", - "actor", "title", - "user_agent", - "user_id", - "request_id", - "read_only", - "token_scopes", - "programmatic_access_type" + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10357,18 +15567,32 @@ "description": "A pull request was closed without being merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" @@ -10378,21 +15602,32 @@ "description": "A pull request was converted to a draft.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" }, @@ -10401,19 +15636,32 @@ "description": "A pull request was created.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -10424,23 +15672,35 @@ "description": "A review was requested on a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -10450,17 +15710,31 @@ "description": "A pull request was marked as in progress.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "business_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -10468,19 +15742,32 @@ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -10488,19 +15775,32 @@ "description": "A pull request was merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" @@ -10510,21 +15810,32 @@ "description": "A pull request was marked as ready for review.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" }, @@ -10533,27 +15844,34 @@ "description": "A pull request was rebased.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "pull_request_url", "pull_request_title", - "user", - "user_id", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -10561,23 +15879,35 @@ "description": "A review request was removed from a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" }, @@ -10586,18 +15916,32 @@ "description": "A pull request was reopened after previously being closed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -10605,19 +15949,31 @@ "description": "A review comment was added to a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "comment_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -10627,20 +15983,31 @@ "description": "A review comment on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", "@timestamp", "_document_id", - "repo", - "created_at", - "request_id", - "comment_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "comment_id", + "operation_type" ] }, { @@ -10648,18 +16015,31 @@ "description": "A review comment on a pull request was changed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor_id", - "action", + "operation_type", "created_at", - "actor", - "_document_id", - "@timestamp", - "comment_id", - "token_scopes", - "programmatic_access_type" + "comment_id" ] }, { @@ -10667,21 +16047,33 @@ "description": "A review on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ] }, { @@ -10689,20 +16081,33 @@ "description": "A review on a pull request was dismissed.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" }, @@ -10711,19 +16116,33 @@ "description": "A review on a pull request was submitted.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" @@ -10733,22 +16152,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -10757,21 +16186,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -10780,25 +16218,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -10807,23 +16252,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -10832,24 +16285,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -10858,23 +16318,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -10884,22 +16352,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -10908,19 +16385,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -10929,24 +16419,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -10955,24 +16455,32 @@ "description": "Autofix for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -10980,24 +16488,32 @@ "description": "Autofix for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11005,24 +16521,32 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11030,24 +16554,32 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11055,23 +16587,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -11082,17 +16623,29 @@ "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", - "action", - "_document_id", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "public_repo", "created_at", "operation_type" ] @@ -11102,17 +16655,29 @@ "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -11122,25 +16687,31 @@ "description": "Code scanning using the default setup was disabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -11149,26 +16720,34 @@ "description": "Code scanning using the default setup was enabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "query_suite", "threat_model", - "languages", - "request_access_security_header" + "languages" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -11177,25 +16756,34 @@ "description": "Code scanning using the default setup was updated for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "query_suite", "threat_model", "languages", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Configuring default setup for code scanning" @@ -11205,19 +16793,30 @@ "description": "GitHub Codespaces was granted trusted repository access to this repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -11226,19 +16825,30 @@ "description": "GitHub Codespaces trusted repository access to this repository was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11246,17 +16856,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11265,15 +16888,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -11284,16 +16920,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11303,17 +16952,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo_id", - "repo", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11323,19 +16985,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11344,17 +17017,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11363,26 +17049,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -11391,30 +17083,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -11424,20 +17121,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -11446,25 +17154,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -11473,23 +17189,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -11497,25 +17224,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -11525,23 +17261,32 @@ "description": "A source code archive of a repository was downloaded as a ZIP file.", "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "created_at", "operation_type", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" @@ -11551,23 +17296,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -11575,21 +17330,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -11597,21 +17362,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -11619,22 +17394,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -11642,21 +17426,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -11664,20 +17458,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11685,22 +17490,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -11708,18 +17522,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -11727,22 +17555,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -11750,21 +17588,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -11772,18 +17620,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -11792,22 +17652,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -11816,24 +17685,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -11842,23 +17719,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -11866,26 +17753,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -11894,21 +17786,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -11917,25 +17818,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -11943,22 +17850,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -11967,25 +17884,34 @@ "description": "A branch was renamed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "old_branch", - "new_branch", - "default_branch", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "old_branch", + "new_branch", + "default_branch", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch" @@ -11995,19 +17921,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -12015,17 +17952,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -12034,17 +17986,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -12053,7 +18020,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -12068,23 +18056,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -12094,20 +18091,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -12118,21 +18126,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -12141,22 +18160,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -12165,21 +18194,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -12188,22 +18228,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -12214,16 +18264,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -12233,22 +18294,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -12257,23 +18329,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -12283,19 +18365,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -12303,21 +18395,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -12326,50 +18428,66 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated for a repository.", - "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", - "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", + "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", + "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12378,24 +18496,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12404,25 +18532,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12431,22 +18567,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12455,26 +18600,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -12482,31 +18635,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12515,22 +18675,30 @@ "description": "Someone closed a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", "fields": [ - "actor", - "repo", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "user_agent", - "actor_id", - "request_id", - "action", - "operation_type", - "created_at", - "repo_id", - "_document_id", + "hashed_token", "org", "org_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "About repository security advisories" }, @@ -12539,18 +18707,29 @@ "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "repo", - "org_id", - "actor", + "@timestamp", + "_document_id", "action", - "request_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "_document_id", + "operation_type", "created_at" ] }, @@ -12559,17 +18738,30 @@ "description": "GitHub made a security advisory public in the GitHub Advisory Database.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -12577,22 +18769,31 @@ "action": "repository_advisory.github_withdraw", "description": "GitHub withdrew a security advisory that was published in error.", "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -12600,18 +18801,30 @@ "description": "Someone opened a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", "repo_id", - "action", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -12619,21 +18832,30 @@ "description": "Someone published a security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", "@timestamp", - "actor", - "repo_id", "_document_id", - "repo", - "business_id", - "business", - "request_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "org" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -12641,17 +18863,30 @@ "description": "Someone reopened as draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "repo", - "action", - "created_at", "@timestamp", - "request_id", - "actor_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "public_repo" ] }, @@ -12660,21 +18895,30 @@ "description": "Someone edited a draft or published security advisory.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "repo_id", - "org_id", "business", - "actor", - "user_agent", - "created_at", - "_document_id", "business_id", - "repo", - "action", - "operation_type", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -12682,24 +18926,30 @@ "description": "Branch protections were disabled for the repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -12708,24 +18958,30 @@ "description": "Branch protections were enabled for this repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -12734,19 +18990,30 @@ "description": "Data use settings were disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "repo_id", - "request_id", - "actor_id", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -12755,21 +19022,30 @@ "description": "Data use settings were enabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "org", - "user_id", - "repo_id", "@timestamp", - "request_id", - "actor", + "_document_id", "action", - "operation_type", - "created_at", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org_id", - "_document_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -12778,23 +19054,30 @@ "description": "The dependency graph was disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "repo_id", - "operation_type", - "user_id", - "repo", + "@timestamp", "_document_id", - "actor", - "user", "action", - "@timestamp", - "org_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", - "request_id", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -12803,24 +19086,31 @@ "description": "The dependency graph was enabled for a private repository.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor_id", - "repo_id", + "created_at", "operation_type", - "actor", - "@timestamp", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12829,21 +19119,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -12851,21 +19151,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -12873,21 +19183,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -12895,20 +19216,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -12916,21 +19249,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -12938,19 +19282,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -12958,17 +19315,31 @@ "description": "An organization has reached their repository limit.", "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "limit", - "count", - "owner", - "action", - "_document_id", - "@timestamp", + "count", + "owner", "created_at", "operation_type" ], @@ -12979,17 +19350,31 @@ "description": "An organization is approaching their repository limit.", "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "limit", "count", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -13000,19 +19385,30 @@ "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", "fields": [ - "request_id", - "created_at", + "@timestamp", "_document_id", "action", - "user_agent", - "user", - "business_id", - "business", - "operation_type", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -13021,20 +19417,30 @@ "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "created_at", "@timestamp", - "repo", - "action", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "repo_id", - "actor", - "request_id", - "programmatic_access_type" + "created_at", + "operation_type" ] }, { @@ -13043,20 +19449,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", "created_at", - "org_id", - "action", - "user_id", - "operation_type", - "_document_id", - "actor_id", - "repo" + "operation_type" ] }, { @@ -13064,31 +19479,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -13097,19 +19520,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -13117,8 +19551,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -13127,23 +19560,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -13168,26 +19610,32 @@ "description": "Automatic partner validation checks have been disabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -13196,26 +19644,32 @@ "description": "Automatic partner validation checks have been enabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -13224,23 +19678,30 @@ "description": "A custom pattern was created for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13250,23 +19711,30 @@ "description": "A custom pattern was removed from secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13276,24 +19744,31 @@ "description": "A custom pattern was published for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13303,24 +19778,31 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -13329,24 +19811,31 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13356,23 +19845,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13382,23 +19878,31 @@ "description": "Secret scanning was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "public_repo", - "programmatic_access_type" + "public_repo" ], "docs_reference_titles": "About secret scanning" }, @@ -13407,22 +19911,30 @@ "description": "Secret scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13430,24 +19942,32 @@ "description": "Generic secrets have been disabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13455,22 +19975,31 @@ "description": "Generic secrets have been enabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -13479,24 +20008,32 @@ "description": "Secret scanning for non-provider patterns was disabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -13505,24 +20042,32 @@ "description": "Secret scanning for non-provider patterns was enabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -13531,19 +20076,31 @@ "description": "A role or team was added to the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -13552,24 +20109,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -13578,24 +20143,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -13604,19 +20177,31 @@ "description": "A role or team was removed from the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -13625,26 +20210,31 @@ "description": "Secret scanning push protection was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -13653,26 +20243,31 @@ "description": "Secret scanning push protection was enabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -13681,28 +20276,36 @@ "description": "A code security configuration was applied to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13710,27 +20313,35 @@ "description": "A code security configuration failed to attach to the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13738,28 +20349,36 @@ "description": "A code security configuration was removed from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13767,28 +20386,36 @@ "description": "A code security configuration was removed due to a change in repository or enterprise settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13796,20 +20423,30 @@ "description": "The repository visibility change setting was cleared for an organization or enterprise.", "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", "fields": [ - "created_at", + "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", "business", - "action", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business_id", - "@timestamp", "user_agent", - "actor", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise" }, @@ -13818,20 +20455,30 @@ "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user", - "org_id", - "created_at", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "_document_id", - "@timestamp", - "user_id", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13839,19 +20486,30 @@ "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "_document_id", "@timestamp", - "user_agent", - "user", - "created_at", - "org", - "org_id", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13859,29 +20517,37 @@ "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -13890,29 +20556,37 @@ "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "alert_id", - "alert_number", - "ghsa_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "alert_number", + "ghsa_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -13921,19 +20595,32 @@ "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ - "operation_type", - "request_id", - "repo_id", "@timestamp", - "user_agent", - "alert_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "alert_id", + "created_at", + "alert_number" ], "docs_reference_titles": "About Dependabot alerts" }, @@ -13942,23 +20629,32 @@ "description": "A Dependabot alert was manually dismissed.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "operation_type", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "alert_id", - "actor", - "repo", "created_at", - "org", - "_document_id", - "action", - "actor_id", "dismiss_reason", - "user", "dismiss_comment", "alert_number", "actor_is_bot" @@ -13969,21 +20665,33 @@ "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "public_repo", "owner", - "_document_id", - "@timestamp", "operation_type", - "token_scopes", "alert_number" ] }, @@ -13992,26 +20700,34 @@ "description": "A Dependabot alert was manually reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type", - "business", - "business_id", "public_repo", - "alert_number", - "request_access_security_header" + "alert_number" ] }, { @@ -14019,21 +20735,32 @@ "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", "docs_reference_links": "N/A", "fields": [ - "alert_id", - "repo", - "operation_type", - "action", - "repo_id", - "_document_id", - "user_agent", - "request_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "alert_id", + "operation_type", + "created_at", + "alert_number" ] }, { @@ -14041,21 +20768,35 @@ "description": "A Dependabot alert was withdrawn.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", "created_at", "active", - "action", - "repository_id", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type" ] }, @@ -14064,20 +20805,30 @@ "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", "fields": [ - "org", + "@timestamp", "_document_id", - "repo", - "org_id", - "operation_type", - "created_at", - "actor", "action", - "@timestamp", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" }, @@ -14086,24 +20837,31 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -14111,26 +20869,32 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14138,23 +20902,30 @@ "description": "Dependabot alerts was disabled.", "docs_reference_links": "N/A", "fields": [ - "repo", - "request_id", - "repo_id", - "action", - "actor_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "_document_id", "user_id", - "operation_type", - "token_scopes", - "programmatic_access_type" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14162,23 +20933,30 @@ "description": "Dependabot alerts was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_agent", - "created_at", "@timestamp", - "repo_id", + "_document_id", "action", - "user", - "repo", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor_id", - "_document_id", - "user_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot" ] }, @@ -14187,24 +20965,31 @@ "description": "A status check was marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "org", - "actor_id", "@timestamp", - "business", - "request_id", - "context", - "repo_id", - "action", - "repo", "_document_id", - "operation_type", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "actor", - "created_at", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "context", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -14213,21 +20998,31 @@ "description": "A status check was no longer marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "actor_id", - "actor", - "created_at", - "context", - "operation_type", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "repo_id", "org_id", - "action", - "_document_id", + "programmatic_access_type", "repo", - "programmatic_access_type" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "context", + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -14236,18 +21031,31 @@ "description": "Email notification restrictions for an organization or enterprise were disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -14256,19 +21064,31 @@ "description": "Email notification restrictions for an organization or enterprise were enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -14277,22 +21097,33 @@ "description": "A new custom repository role was created.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "owner", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", - "_document_id", "role_permissions", "old_role_permissions" ], @@ -14303,23 +21134,34 @@ "description": "A custom repository role was deleted.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Managing custom repository roles for an organization" }, @@ -14327,24 +21169,35 @@ "action": "role.update", "description": "A custom repository role was edited.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", - "fields": [ - "user_agent", - "request_id", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "old_role_permissions", "old_base_role" ], @@ -14355,14 +21208,28 @@ "description": "GitHub detected a secret and created a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -14376,14 +21243,28 @@ "description": "A secret scanning alert was leaked in a public repo.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -14398,22 +21279,32 @@ "description": "A secret scanning alert was reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type_display_name" ] }, @@ -14422,14 +21313,28 @@ "description": "A leaked secret was reported to the secret's provider by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "created_at", @@ -14444,28 +21349,37 @@ "description": "A secret scanning alert was resolved.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "resolution", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", + "resolution", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type", "secret_type_display_name", "publicly_leaked", - "multi_repo", - "request_access_security_header" + "multi_repo" ] }, { @@ -14473,25 +21387,32 @@ "description": "A secret scanning alert was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -14499,14 +21420,28 @@ "description": "A secret scanning alert was validated.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "previous_validity", @@ -14523,26 +21458,34 @@ "description": "A request to close a secret scanning alert was approved by a user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "request_reviewer_comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14551,25 +21494,33 @@ "description": "N/A", "docs_reference_links": "A reqeust to close a secret scanning alert was canceled by a user.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "A, reqeust, to, close, a, secret, scanning, alert, was, canceled, by, a, user." @@ -14579,27 +21530,35 @@ "description": "N/A", "docs_reference_links": "A user requested to close a secret scanning alert.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "reason", "comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "A, user, requested, to, close, a, secret, scanning, alert." @@ -14609,26 +21568,34 @@ "description": "A request to close a secret scanning alert was denied by a user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "request_reviewer_comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14637,19 +21604,30 @@ "description": "Secret scanning was disabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -14658,19 +21636,30 @@ "description": "Secret scanning was enabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -14679,20 +21668,30 @@ "description": "Secret scanning was disabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -14701,19 +21700,30 @@ "description": "Secret scanning was enabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -14722,14 +21732,28 @@ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "push_protection_bypass_reason", @@ -14747,25 +21771,33 @@ "description": "A request to bypass secret scanning push protection was approved by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -14774,25 +21806,33 @@ "description": "A request to bypass secret scanning push protection was denied by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", - "request_access_security_header", "request_reviewer_comment" ], "docs_reference_titles": "About push protection" @@ -14802,25 +21842,33 @@ "description": "A user requested to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" }, @@ -14829,22 +21877,35 @@ "description": "A secret scanning scan has completed on this repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "repo_id", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "source", "type", "source_slug", "type_slug", "started_at", "completed_at", - "repo", "public_repo", - "org", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "secret_types", @@ -14858,10 +21919,28 @@ "description": "A security configuration was created", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -14876,15 +21955,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -14902,22 +21974,33 @@ "description": "A default security configuration setting for new repositories was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14926,22 +22009,33 @@ "description": "A default security configuration setting for new repositories was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14950,10 +22044,28 @@ "description": "A security configuration was deleted", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -14968,15 +22080,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -14993,15 +22098,30 @@ "description": "A security configuration policy was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enforcement", "security_configuration_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15011,10 +22131,28 @@ "description": "A security configuration was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15029,15 +22167,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -15055,16 +22186,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15074,18 +22218,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -15094,16 +22251,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15113,15 +22283,28 @@ "description": "An agreement for invoiced billing for GitHub Sponsors was signed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -15133,15 +22316,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -15151,15 +22347,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -15168,17 +22379,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -15187,17 +22411,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -15206,16 +22444,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -15225,14 +22476,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -15242,17 +22508,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -15260,18 +22539,31 @@ "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", - "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", + "fields": [ "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -15280,18 +22572,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15300,15 +22605,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -15318,16 +22637,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -15335,15 +22667,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -15354,16 +22699,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -15373,17 +22731,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -15394,17 +22765,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -15415,18 +22799,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15436,16 +22831,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15455,16 +22863,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15476,17 +22897,30 @@ "fields": [ "@timestamp", "_document_id", - "fingerprint", - "operation_type", - "openssh_public_key", - "org_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "request_id" + "fingerprint", + "operation_type", + "openssh_public_key", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15495,19 +22929,32 @@ "description": "An SSH certificate authority for an organization or enterprise was deleted.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "created_at", + "@timestamp", "_document_id", - "fingerprint", - "operation_type", + "action", "actor", - "org_id", - "openssh_public_key", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", - "request_id" + "created_at", + "fingerprint", + "operation_type", + "openssh_public_key" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15516,21 +22963,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "user", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "request_id", - "org", - "org_id", - "created_at", - "actor", "action", - "user_id", + "actor", + "actor_id", "business", "business_id", - "@timestamp", - "actor_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15539,19 +22995,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "actor_id", - "user_id", - "org", - "operation_type", - "request_id", "@timestamp", "_document_id", - "actor", - "user", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15560,15 +23027,28 @@ "description": "Dependabot encrypted config was read.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "public_repo" @@ -15579,20 +23059,34 @@ "description": "The verification code expiry time for an organization or enterprise domain was set.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "token_expires_at", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15600,18 +23094,33 @@ "description": "An organization or enterprise domain was unverified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ] }, { @@ -15619,16 +23128,31 @@ "description": "An organization or enterprise domain was verified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "domain_name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15636,23 +23160,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15660,23 +23194,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15684,23 +23228,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15708,23 +23262,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15732,21 +23296,31 @@ "description": "A member of an organization was added to a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", "fields": [ - "user_agent", - "request_id", - "org_id", - "user_id", - "team", - "user", "@timestamp", - "actor_id", - "created_at", - "operation_type", "_document_id", - "org", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" @@ -15756,22 +23330,31 @@ "description": "A team was given access and permissions to a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "team", - "action", - "operation_type", - "request_id", - "created_at", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "actor_id", - "_document_id", "repo_id", - "user_agent", - "org_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -15780,20 +23363,31 @@ "description": "A child team was created or a child team's parent was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", "fields": [ - "org", "@timestamp", - "created_at", "_document_id", - "team", "action", - "operation_type", "actor", - "request_id", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", + "operation_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" }, @@ -15802,18 +23396,31 @@ "description": "A team's privacy level was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", "fields": [ - "user_agent", - "request_id", - "org", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", "created_at", "operation_type", - "actor_id", - "org_id", - "@timestamp", - "actor", - "_document_id", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" @@ -15823,21 +23430,32 @@ "description": "A new team is created.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "oauth_application_id", + "operation_type", "team", - "org", - "actor", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "team_type" ] }, @@ -15846,21 +23464,31 @@ "description": "A user was demoted from a team maintainer to a team member.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" }, @@ -15869,19 +23497,31 @@ "description": "A team was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "team", "org_id", - "actor_id", - "actor", - "action", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", "operation_type", - "_document_id", - "programmatic_access_type", "team_type" ] }, @@ -15890,19 +23530,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "business_id", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", "actor_id", - "user", "business", - "action", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15910,19 +23561,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "operation_type", - "request_id", "actor", - "org", - "created_at", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", - "_document_id" + "operation_type", + "created_at" ] }, { @@ -15930,18 +23592,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", "@timestamp", - "action", "_document_id", - "user_agent", - "user_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business", + "user_id", + "user_agent", "operation_type", - "actor", "created_at" ] }, @@ -15950,19 +23623,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "actor", - "action", - "operation_type", - "team", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "team" ] }, { @@ -15970,19 +23655,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", "@timestamp", - "actor_id", "_document_id", - "team", - "created_at", - "org_id", "action", - "request_id", - "user_agent", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_access_security_header" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "team", + "created_at" ] }, { @@ -15990,22 +23687,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "team", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at" ] }, { @@ -16013,22 +23719,31 @@ "description": "A user was promoted from a team member to a team maintainer.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" }, @@ -16037,22 +23752,31 @@ "description": "An organization member was removed from a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", "fields": [ - "request_id", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "team", - "user_id", - "actor", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", + "user_id", "user_agent", - "_document_id", - "token_scopes", - "programmatic_access_type", + "operation_type", + "created_at", + "team", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" @@ -16060,23 +23784,33 @@ { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A", - "fields": [ - "request_id", - "org_id", - "repo", - "repo_id", - "action", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "created_at", "team", - "org", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -16084,21 +23818,32 @@ "description": "A team's name was changed.", "docs_reference_links": "N/A", "fields": [ - "name", - "user_agent", - "created_at", - "team", - "operation_type", - "actor_id", - "org", + "@timestamp", + "_document_id", "action", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "_document_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "team", + "operation_type", "team_type" ] }, @@ -16107,17 +23852,30 @@ "description": "Team synchronization with a tenant was disabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "request_id", - "org_id", "actor_id", - "operation_type", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -16126,19 +23884,30 @@ "description": "Team synchronization with a tenant was enabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ - "org_id", - "business_id", - "actor", - "created_at", - "user_agent", "@timestamp", - "operation_type", - "business", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -16147,19 +23916,30 @@ "description": "The Okta credentials for team synchronization with a tenant were changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -16167,28 +23947,37 @@ "description": "A team's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "team", - "org_id", "@timestamp", - "org", "_document_id", - "old_permission", - "request_id", - "repo", "action", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "old_permission", "operation_type", "created_at", - "user_agent", "permission", "new_repo_permission", "new_repo_base_role", "old_repo_permission", - "old_repo_base_role", - "token_scopes", - "programmatic_access_type" + "old_repo_base_role" ] }, { @@ -16196,16 +23985,30 @@ "description": "A Dependabot rule was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16215,16 +24018,30 @@ "description": "A Dependabot rule was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16234,18 +24051,31 @@ "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16255,21 +24085,33 @@ "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -16277,21 +24119,32 @@ "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -16299,21 +24152,32 @@ "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -16321,16 +24185,30 @@ "description": "A Dependabot rule's conditions, actions, or metadata changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16340,27 +24218,33 @@ "description": "A workflow job was approved.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", - "repo", - "repo_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -16369,23 +24253,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -16393,10 +24287,28 @@ "description": "A workflow run was cancelled.", "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -16407,20 +24319,9 @@ "run_number", "cancelled_at", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Canceling a workflow run" }, @@ -16429,23 +24330,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16455,10 +24364,28 @@ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -16470,19 +24397,9 @@ "conclusion", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -16493,10 +24410,28 @@ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -16505,21 +24440,10 @@ "head_branch", "head_sha", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "public_repo", - "programmatic_access_type", "actor_is_bot", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "Understanding GitHub Actions" @@ -16529,23 +24453,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -16554,22 +24490,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16577,21 +24524,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -16599,25 +24557,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16625,23 +24591,36 @@ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", "fields": [ - "repo_id", - "repo", - "org_id", - "org", - "business_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "job_name", "runner_labels", "is_hosted_runner", "environment_name", "secrets_passed", - "action", - "_document_id", "operation_type", "created_at", - "@timestamp", "runner_owner_type", "job_workflow_ref", "calling_workflow_refs", @@ -16655,24 +24634,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -16681,10 +24669,28 @@ "description": "A workflow run was re-run.", "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -16694,21 +24700,11 @@ "head_sha", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", "rerun_type", "check_run_id", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "Re-running workflows and jobs" @@ -16718,25 +24714,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.17/user.json b/src/audit-logs/data/ghes-3.17/user.json index 1b7dfef9655a..35b1e5e0f5d6 100644 --- a/src/audit-logs/data/ghes-3.17/user.json +++ b/src/audit-logs/data/ghes-3.17/user.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,17 +67,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "request_id", "@timestamp", - "user_agent", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", - "user_id", + "token_scopes", "user", - "actor", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -61,18 +98,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", + "token_scopes", "user", - "request_id", - "_document_id", - "user_agent", - "actor", "user_id", - "actor_id", - "operation_type", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -80,18 +129,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "actor_id", - "operation_type", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "token_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -99,29 +160,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -129,18 +196,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -148,17 +227,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -167,19 +259,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -188,18 +292,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -207,18 +324,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -226,15 +355,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -244,26 +386,36 @@ "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -271,24 +423,34 @@ "description": "A CSV export was requested on the \"Coverage\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -296,26 +458,36 @@ "description": "A CSV export was requested on the \"Overview Dashboard\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -323,20 +495,31 @@ "description": "A CSV export was requested on the \"Risk\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -347,17 +530,30 @@ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "created_at", "operation_type" ], @@ -368,20 +564,32 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -390,19 +598,32 @@ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "limit", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -411,19 +632,31 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -432,20 +665,32 @@ "description": "The policy for fork pull request workflows was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -454,19 +699,31 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -475,20 +732,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -497,20 +765,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -521,17 +800,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -539,14 +830,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -556,25 +862,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -585,22 +900,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -612,22 +938,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -636,36 +973,64 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "owner", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "public_repo" - ] - }, + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "owner", + "created_at", + "operation_type", + "public_repo" + ] + }, { "action": "codespaces.restore", "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -675,27 +1040,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "org", "owner", "pull_request_id", "machine_type", - "user_id", - "user", "devcontainer_path", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -703,19 +1077,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -723,18 +1110,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -743,23 +1142,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -767,16 +1173,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -785,24 +1205,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -810,15 +1236,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -828,40 +1267,62 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "request_access_security_header" - ] - }, - { - "action": "copilot.cfb_seat_cancelled", - "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "copilot.cfb_seat_cancelled", + "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -869,21 +1330,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -891,21 +1361,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "owner_type", "actor_id", - "user_id", - "owner", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "_document_id", - "@timestamp", + "user_id", + "user_agent", + "owner_type", + "owner", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -913,21 +1394,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "owner_type", "actor_id", - "user_id", - "owner", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "_document_id", - "@timestamp", + "user_id", + "user_agent", + "owner_type", + "owner", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -935,21 +1427,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -959,19 +1460,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -981,21 +1491,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1005,19 +1524,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1026,19 +1556,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1047,19 +1588,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1068,19 +1620,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1089,17 +1652,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1107,19 +1683,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1128,19 +1715,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1148,19 +1746,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1169,19 +1778,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1189,19 +1809,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1210,39 +1841,61 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" - ] - }, - { - "action": "dependency_graph_new_repos.disable", - "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", - "fields": [ - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "created_at", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "dependency_graph_new_repos.disable", + "description": "The dependency graph was disabled for all new repositories.", + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1251,20 +1904,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1272,22 +1935,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1296,22 +1968,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1319,28 +2001,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1349,27 +2037,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -1378,25 +2074,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1405,49 +2109,68 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.remove_actions_variable", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at", + "public_repo" + ], + "docs_reference_titles": "Managing environments for deployment" + }, + { + "action": "environment.remove_actions_variable", "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1456,22 +2179,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1480,25 +2213,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1507,22 +2249,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1531,21 +2285,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -1556,21 +2320,32 @@ "description": "A gist was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "gist_id", - "@timestamp", "created_at", "operation_type", - "user_agent", - "actor", - "actor_id", - "visibility", - "action", - "_document_id", - "token_scopes", - "programmatic_access_type" + "visibility" ] }, { @@ -1578,20 +2353,32 @@ "description": "A gist was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "gist_id", - "visibility", - "created_at", + "@timestamp", "_document_id", - "user", - "request_id", - "operation_type", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "@timestamp", - "programmatic_access_type" + "gist_id", + "visibility", + "created_at", + "operation_type" ] }, { @@ -1599,21 +2386,32 @@ "description": "The visibility of a gist was updated.", "docs_reference_links": "N/A", "fields": [ - "action", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", - "user", - "gist_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "visibility", - "user_id", - "created_at", - "_document_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "gist_id", + "visibility", + "created_at" ] }, { @@ -1621,22 +2419,33 @@ "description": "An SSH key was added to a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -1645,23 +2454,34 @@ "description": "An SSH key was removed from a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", "explanation", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -1670,23 +2490,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1694,18 +2523,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1716,20 +2555,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1739,18 +2588,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "created_at", - "user_id", "@timestamp", - "user", - "operation_type", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -1758,18 +2619,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "created_at", - "_document_id", + "user_id", "user_agent", - "@timestamp", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -1777,25 +2650,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -1803,25 +2686,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -1829,26 +2721,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -1857,25 +2758,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -1883,26 +2793,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -1910,21 +2829,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -1933,19 +2863,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -1953,21 +2896,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -1976,19 +2930,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -1999,20 +2967,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2022,24 +3002,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2050,23 +3041,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2077,20 +3080,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2100,19 +3116,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -2121,20 +3151,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -2144,20 +3187,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -2166,20 +3222,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -2188,20 +3257,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -2209,19 +3290,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2230,38 +3324,64 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "name", - "integration", - "user", - "user_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", - "application_client_id" - ] - }, - { - "action": "integration.suspend", - "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", - "fields": [ + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", + "operation_type", + "created_at", + "application_client_id" + ] + }, + { + "action": "integration.suspend", + "description": "A GitHub App was suspended.", + "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2274,21 +3394,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -2302,17 +3435,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2324,18 +3470,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2343,21 +3501,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -2365,21 +3536,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -2387,22 +3571,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -2410,19 +3607,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -2433,21 +3643,36 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "actor", + "_document_id", "action", - "operation_type", - "marketplace_listing", - "has_free_trial", - "user_agent", - "request_id", + "actor", "actor_id", - "yearly_price_in_cents", - "description", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "marketplace_listing", + "has_free_trial", + "yearly_price_in_cents", + "description", "bullets", "monthly_price_in_cents", - "marketplace_listing_plan", - "_document_id" + "marketplace_listing_plan" ] }, { @@ -2455,22 +3680,37 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "marketplace_listing_plan", "marketplace_listing", "description", "bullets", "has_free_trial", "created_at", - "actor_id", "operation_type", - "_document_id", - "action", - "user_agent", - "request_id", - "actor", "monthly_price_in_cents", - "yearly_price_in_cents", - "@timestamp" + "yearly_price_in_cents" ] }, { @@ -2478,21 +3718,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor", - "marketplace_listing_plan", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "marketplace_listing_plan", "description", "yearly_price_in_cents", - "@timestamp", "created_at", - "actor_id", "bullets", "has_free_trial", "marketplace_listing", - "user_agent", "monthly_price_in_cents", - "action", "operation_type" ] }, @@ -2501,21 +3756,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "monthly_price_in_cents", - "marketplace_listing", + "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "monthly_price_in_cents", + "marketplace_listing", "description", "bullets", "yearly_price_in_cents", - "request_id", - "actor_id", "has_free_trial", "marketplace_listing_plan", - "user_agent", - "@timestamp", "operation_type", - "actor", "created_at" ] }, @@ -2524,22 +3794,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -2547,22 +3830,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2570,19 +3866,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2590,21 +3898,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2614,16 +3931,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2633,18 +3963,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "max_entries_to_build", - "min_entries_to_merge", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "_document_id", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "max_entries_to_build", + "min_entries_to_merge", + "public_repo", "created_at", "operation_type" ] @@ -2654,14 +3997,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -2669,19 +4028,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -2689,18 +4059,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2708,23 +4090,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -2732,20 +4122,30 @@ "description": "An OAuth access token was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", "fields": [ - "_document_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "user", - "user_id", - "created_at", + "_document_id", "action", + "actor", "actor_id", - "request_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" @@ -2756,19 +4156,30 @@ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", "fields": [ "@timestamp", - "user_agent", - "action", - "operation_type", "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_id", + "user_agent", + "operation_type", + "created_at", "explanation", - "hashed_token", - "actor_id", - "token_scopes", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" @@ -2778,19 +4189,30 @@ "description": "An OAuth access token was regenerated.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "_document_id", - "created_at", "@timestamp", - "operation_type", + "_document_id", "action", - "user_agent", - "request_id", "actor", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "oauth_application_name" ] }, @@ -2799,16 +4221,28 @@ "description": "An OAuth access token was revoked.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "request_access_security_header", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -2818,39 +4252,63 @@ "description": "An OAuth access token was updated.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", "action", - "@timestamp", - "user", - "user_agent", - "request_access_security_header" - ] - }, - { - "action": "oauth_application.create", - "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "org", - "created_at", - "oauth_application_id", - "operation_type", - "user_agent", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "actor", - "oauth_application", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "oauth_application.create", + "description": "An OAuth application was created.", + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2859,20 +4317,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2881,20 +4351,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2903,20 +4385,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2925,19 +4419,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2946,20 +4453,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2968,20 +4487,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2990,19 +4521,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3011,24 +4555,31 @@ "description": "An authorization for an OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ - "operation_type", - "user_agent", - "user_id", - "actor", - "org_id", + "@timestamp", "_document_id", - "request_id", "action", - "@timestamp", - "created_at", + "actor", "actor_id", - "user", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_is_bot", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -3038,20 +4589,31 @@ "description": "An authorization for an OAuth application was deleted.", "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", "fields": [ - "user_agent", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "actor", "created_at", "explanation", - "user", - "user_id", - "org_id", - "action", - "actor_id", - "token_scopes", "actor_is_bot", "oauth_application_name" ], @@ -3062,20 +4624,31 @@ "description": "An authorization for an OAuth application was updated.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", - "actor_id", "user_agent", - "@timestamp", "operation_type", - "action", - "user", "created_at", - "_document_id", "actor_is_bot", - "request_access_security_header", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -3085,21 +4658,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -3108,24 +4691,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3133,20 +4726,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -3154,22 +4757,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -3177,20 +4788,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -3198,22 +4819,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -3221,48 +4850,66 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" - ] + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] }, { "action": "org.security_center_export_code_scanning_metrics", "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -3271,26 +4918,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3298,28 +4953,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3327,26 +4990,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3354,20 +5025,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -3376,16 +5058,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -3396,18 +5091,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -3416,18 +5124,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -3436,18 +5156,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -3456,18 +5189,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -3477,20 +5222,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -3498,17 +5254,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -3518,20 +5287,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -3540,20 +5320,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -3562,17 +5356,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3583,20 +5392,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -3605,19 +5428,31 @@ "description": "A new passkey was added.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3625,19 +5460,31 @@ "description": "A new passkey was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3645,35 +5492,61 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" - ] - }, - { - "action": "payment_method.remove", - "description": "A payment method was removed.", - "docs_reference_links": "N/A", - "fields": [ - "user", - "created_at", - "actor_id", - "@timestamp", - "user_id", - "action", - "operation_type", - "actor", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "payment_method.remove", + "description": "A payment method was removed.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", "_document_id", - "request_access_security_header" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3681,18 +5554,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -3700,18 +5585,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3722,18 +5620,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3744,17 +5655,30 @@ "description": "Triggered when you create a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3764,19 +5688,31 @@ "description": "Triggered when you regenerate a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3784,12 +5720,29 @@ "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", "fields": [ - "user_programmatic_access_name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", "operation_type" ], @@ -3800,20 +5753,32 @@ "description": "Triggered when you delete a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "explanation", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3821,17 +5786,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -3842,18 +5820,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -3865,17 +5856,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -3887,17 +5891,30 @@ "description": "A fine-grained personal access token was updated.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3908,15 +5925,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3926,17 +5958,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -3946,15 +5989,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3964,17 +6022,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -3984,17 +6053,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4004,17 +6084,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4024,17 +6115,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4044,19 +6146,32 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", - "request_id", - "user_agent", + "action", "actor", - "operation_type" - ], + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "owner", + "operation_type" + ], "docs_reference_titles": "Personalize your profile" }, { @@ -4064,17 +6179,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4082,20 +6210,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -4105,25 +6244,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -4131,20 +6282,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4152,25 +6315,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4178,17 +6353,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -4196,17 +6384,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -4214,18 +6415,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -4234,39 +6447,62 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" - }, - { - "action": "project.link", - "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A", - "fields": [ + "programmatic_access_type", + "repo", "repo_id", - "action", - "actor_id", - "org_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "operation_type", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + }, + { + "action": "project.link", + "description": "A repository was linked to a project board.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", "_document_id", - "created_at", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "repo" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4274,17 +6510,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -4296,22 +6545,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -4319,19 +6577,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -4339,17 +6608,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4357,18 +6639,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -4376,20 +6671,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4397,18 +6702,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -4417,36 +6734,61 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" - }, - { - "action": "project.visibility_private", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + }, + { + "action": "project.visibility_private", "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -4458,21 +6800,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -4480,18 +6834,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4502,23 +6869,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -4527,24 +6905,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -4553,20 +6942,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4575,21 +6978,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -4599,22 +7015,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4623,25 +7051,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", - "actor", - "key", - "fingerprint", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "fingerprint", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4650,23 +7088,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", "key", "fingerprint", - "actor_id", - "actor", "title", - "user_agent", - "user_id", - "request_id", - "read_only", - "token_scopes", - "programmatic_access_type" + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4675,22 +7124,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -4699,21 +7158,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -4722,25 +7190,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -4749,23 +7224,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -4774,24 +7257,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -4800,23 +7290,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -4826,22 +7324,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -4850,19 +7357,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -4871,24 +7391,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -4897,23 +7427,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4924,17 +7463,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -4943,15 +7495,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -4962,16 +7527,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -4981,17 +7559,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -5001,19 +7592,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -5022,17 +7624,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -5041,26 +7656,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -5069,30 +7690,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -5102,20 +7728,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5124,25 +7761,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5151,23 +7796,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -5175,25 +7831,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -5203,23 +7868,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -5227,21 +7902,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -5249,21 +7934,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -5271,22 +7966,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -5294,21 +7998,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -5316,20 +8030,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -5337,22 +8062,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -5360,18 +8094,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5379,22 +8127,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5402,21 +8160,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -5424,18 +8192,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -5444,48 +8224,65 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" - ], - "docs_reference_titles": "Using secrets in GitHub Actions" - }, + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Using secrets in GitHub Actions" + }, { "action": "repo.remove_actions_variable", "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5494,23 +8291,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -5518,26 +8325,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -5546,21 +8358,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -5569,25 +8390,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -5595,22 +8422,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -5619,19 +8456,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -5639,23 +8487,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -5665,20 +8522,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -5689,21 +8557,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -5712,22 +8591,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -5736,21 +8625,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -5759,22 +8659,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -5785,16 +8695,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -5803,22 +8724,31 @@ "description": "Temporary access was enabled for a repository.", "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing user-owned repositories in your enterprise" }, @@ -5828,22 +8758,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -5852,23 +8793,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -5878,41 +8829,61 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" - ] - }, - { - "action": "repo.unarchived", - "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository", - "fields": [ - "actor", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "repo", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", + "visibility" + ] + }, + { + "action": "repo.unarchived", + "description": "A repository was unarchived.", + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -5921,24 +8892,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -5946,25 +8926,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5973,24 +8960,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -5999,25 +8996,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -6026,22 +9031,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -6050,26 +9064,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -6077,31 +9099,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -6110,21 +9139,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -6132,21 +9171,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -6154,21 +9203,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -6176,20 +9236,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -6197,21 +9269,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -6219,19 +9302,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -6239,31 +9335,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -6272,19 +9376,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -6292,8 +9407,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -6302,23 +9416,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -6343,18 +9466,30 @@ "description": "A security key was registered for an account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "created_at", - "user_id", - "action", - "operation_type", - "request_id", "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -6362,18 +9497,30 @@ "description": "A security key was removed from an account.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "operation_type", - "_document_id", - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6381,16 +9528,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6400,18 +9560,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -6420,16 +9593,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6440,15 +9626,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -6458,15 +9657,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -6475,17 +9689,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -6494,17 +9721,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -6513,33 +9754,61 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", - "request_id", - "user_id", - "created_at", - "user", "_document_id", - "user_agent", - "actor", - "operation_type" - ], - "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" - }, - { - "action": "sponsors.sponsor_sponsorship_tier_change", - "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", - "fields": [ - "user_id", + "action", "actor", "actor_id", - "action", - "user", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + }, + { + "action": "sponsors.sponsor_sponsorship_tier_change", + "description": "A sponsorship was upgraded or downgraded.", + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -6549,17 +9818,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -6568,17 +9850,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -6587,18 +9882,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6607,15 +9915,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -6625,16 +9947,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6642,15 +9977,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -6661,16 +10009,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -6680,17 +10041,30 @@ "description": "Triggered when you send an email update to your sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", "fields": [ - "request_id", - "actor", - "action", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" }, @@ -6699,17 +10073,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ - "actor", - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -6720,17 +10107,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -6741,18 +10141,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6762,16 +10173,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6781,17 +10205,30 @@ "description": "You join the waitlist to join GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "actor_id", - "action", "operation_type", - "created_at", - "user", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -6800,16 +10237,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6819,23 +10269,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6843,23 +10303,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6867,23 +10337,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6891,39 +10371,64 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "actor_is_bot", - "request_access_security_header" - ] - }, + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", + "public_repo", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, { "action": "successor_invitation.accept", "description": "Triggered when you accept a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6932,15 +10437,30 @@ "description": "Triggered when you cancel a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6949,15 +10469,30 @@ "description": "Triggered when you create a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6966,15 +10501,30 @@ "description": "Triggered when you decline a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6983,15 +10533,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6999,15 +10564,30 @@ "description": "Triggered when you revoke a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7016,17 +10596,30 @@ "description": "A new trusted device was added.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7034,17 +10627,30 @@ "description": "A trusted device was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7052,14 +10658,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "action", - "request_id", - "user_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -7068,29 +10689,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "created_at", - "user_id", - "operation_type", - "user", "_document_id", - "user_agent", - "action" - ] - }, - { - "action": "two_factor_account_recovery.ignore", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "two_factor_account_recovery.ignore", "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "created_at", - "user_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7098,17 +10751,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "operation_type", - "action", - "_document_id" + "created_at", + "operation_type" ] }, { @@ -7116,17 +10782,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user", - "created_at", - "request_id", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -7134,16 +10813,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7151,15 +10844,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_id", - "action", "@timestamp", - "created_at", - "user_agent", - "user", "_document_id", - "request_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7167,18 +10875,30 @@ "description": "A secondary authentication factor was added to a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -7187,18 +10907,30 @@ "description": "Two-factor authentication was disabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", "fields": [ - "actor", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor_id", + "user_agent", "created_at", - "operation_type", - "request_id", - "@timestamp", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Disabling two-factor authentication for your personal account" }, @@ -7207,18 +10939,30 @@ "description": "Two-factor authentication was enabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ - "actor", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Configuring two-factor authentication" }, @@ -7227,52 +10971,92 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user", - "user_id", - "action", "@timestamp", - "request_id", - "_document_id", - "user_agent" - ] - }, - { - "action": "two_factor_authentication.recovery_codes_regenerated", - "description": "Two factor recovery codes were regenerated for a user account.", - "docs_reference_links": "N/A", - "fields": [ - "request_id", - "actor", - "operation_type", "_document_id", - "user_id", "action", - "user", - "user_agent", + "actor", "actor_id", - "@timestamp", - "created_at" - ] + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "two_factor_authentication.recovery_codes_regenerated", + "description": "Two factor recovery codes were regenerated for a user account.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] }, { "action": "two_factor_authentication.remove_factor", "description": "A secondary authentication factor was removed from a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -7281,15 +11065,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "created_at", - "_document_id", - "action", - "@timestamp" + "operation_type", + "created_at" ] }, { @@ -7298,16 +11097,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "operation_type", "user_agent", - "action", - "request_id", - "actor", - "actor_id" + "created_at", + "operation_type" ] }, { @@ -7315,19 +11127,31 @@ "description": "An email address was added to a user account.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", "operation_type", - "_document_id", - "actor_id", - "actor", "email", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding an email address to your GitHub account" }, @@ -7336,18 +11160,30 @@ "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "created_at", - "user", "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -7355,15 +11191,28 @@ "description": "Audit log entries were exported.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "action", - "request_id", - "actor", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", "created_at" ] @@ -7373,20 +11222,31 @@ "description": "A user was blocked by another user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_id", - "_document_id", "actor_id", - "@timestamp", - "user_agent", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -7394,18 +11254,30 @@ "description": "A user changed their password.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "actor_id", - "operation_type", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "created_at", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7413,18 +11285,30 @@ "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -7433,17 +11317,30 @@ "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -7452,19 +11349,31 @@ "description": "A new user account was created.", "docs_reference_links": "N/A", "fields": [ - "email", - "user_id", - "operation_type", "@timestamp", - "request_id", - "user", - "created_at", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "action", - "programmatic_access_type" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "email", + "operation_type", + "created_at" ] }, { @@ -7472,21 +11381,33 @@ "description": "A user secret for Codespaces was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7494,20 +11415,31 @@ "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "user_agent", + "@timestamp", "_document_id", - "operation_type", - "oauth_application_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "@timestamp", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -7515,18 +11447,30 @@ "description": "A user account was destroyed by an asynchronous job.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "request_id", - "user_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7535,19 +11479,30 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "oauth_application_id", + "_document_id", "action", - "user", - "created_at", - "user_agent", - "request_id", "actor", "actor_id", - "operation_type", - "_document_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", + "operation_type" ] }, { @@ -7555,18 +11510,30 @@ "description": "A user deleted his or her account, triggering user.async_delete.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", - "created_at", - "user_agent", "user_id", - "operation_type", - "actor_id", - "action", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7574,18 +11541,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "user_agent", "user_id", - "actor_id", - "action", - "operation_type", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7593,37 +11572,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user_id", - "actor", - "operation_type", - "created_at", - "_document_id", "@timestamp", - "user", - "actor_id", + "_document_id", "action", - "request_access_security_header" - ] - }, - { + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { "action": "user.device_verification_success", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user", "_document_id", "action", - "operation_type", - "user_agent", - "created_at", - "request_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7631,17 +11634,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7649,17 +11665,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7667,17 +11696,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7685,21 +11727,31 @@ "description": "An enterprise managed user claimed an email address.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7707,21 +11759,31 @@ "description": "N/A", "docs_reference_links": "An enterprise managed user unclaimed an email address.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." }, @@ -7730,17 +11792,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7748,17 +11823,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7766,17 +11854,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7784,36 +11885,62 @@ "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "action", - "operation_type", - "request_id", - "created_at", - "_document_id", "@timestamp", - "user", - "org_id", + "_document_id", + "action", "actor", "actor_id", - "user_agent" - ] - }, - { - "action": "user.forgot_password", - "description": "A user requested a password reset.", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "user.forgot_password", + "description": "A user requested a password reset.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", "fields": [ - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "email", - "created_at", - "user_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" }, @@ -7822,17 +11949,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "created_at", - "user_agent", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor", - "operation_type", - "request_id" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7840,18 +11980,30 @@ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -7860,19 +12012,31 @@ "description": "A user signed in.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "actor_id", "@timestamp", - "user", - "action", - "operation_type", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "actor", - "passkey_nickname", - "request_access_security_header" + "passkey_nickname" ] }, { @@ -7880,18 +12044,30 @@ "description": "A user signed out.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7899,18 +12075,30 @@ "description": "A user signed in from a new device.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7918,21 +12106,31 @@ "description": "An ordinary user account was promoted to a site administrator.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", + "user_id", "user_agent", + "created_at", "oauth_application_id", - "request_id", - "operation_type", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7940,16 +12138,29 @@ "description": "A user's account was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user", - "action", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "actor", "operation_type" ] }, @@ -7958,20 +12169,31 @@ "description": "An email address was removed from a user account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "actor", - "actor_id", "created_at", - "email", - "token_scopes", - "programmatic_access_type" + "email" ] }, { @@ -7979,20 +12201,32 @@ "description": "A user secret for Codespaces was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "key", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "key", + "integration", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8000,20 +12234,31 @@ "description": "A username was changed.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "request_id", - "actor_id", - "old_login", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "operation_type", "user_agent", - "token_scopes", - "programmatic_access_type" + "old_login", + "created_at", + "operation_type" ] }, { @@ -8021,18 +12266,30 @@ "description": "A user reset their account password.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "@timestamp", - "_document_id", - "actor", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8040,16 +12297,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_id", - "action", "@timestamp", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -8060,16 +12330,28 @@ "fields": [ "@timestamp", "_document_id", - "request_id", - "user_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor_id", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -8078,18 +12360,30 @@ "description": "A user signed in from an unrecognized device.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "created_at", - "actor", - "actor_id", - "@timestamp", - "request_access_security_header" + "created_at" ] }, { @@ -8097,18 +12391,30 @@ "description": "A user signed in from an unrecognized device and location.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "created_at", - "_document_id", - "request_id", - "action", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8116,22 +12422,33 @@ "description": "Triggered when you clear the status on your profile.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "message", - "user", - "actor_id", "created_at", - "request_id", "limited_availability", - "action", "emoji", - "operation_type", - "user_agent", - "@timestamp", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -8139,23 +12456,33 @@ "description": "Triggered when you set or change the status on your profile.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", "fields": [ - "limited_availability", - "user", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "message", - "user_id", - "created_at", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "limited_availability", + "message", + "created_at", "emoji", - "org", - "actor", - "operation_type", - "token_scopes", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Personalize your profile" }, @@ -8164,21 +12491,31 @@ "description": "A user account was suspended.", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", - "operation_type", - "actor_id", - "user", - "user_agent", - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", - "user_id", + "_document_id", "action", - "token_scopes", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -8186,18 +12523,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", - "actor_id", "@timestamp", - "operation_type", "_document_id", - "user_agent", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8205,18 +12554,30 @@ "description": "A 2FA challenge issued for a user account failed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "_document_id", - "user_agent", - "user", - "actor_id", - "actor", - "user_id", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8226,16 +12587,28 @@ "fields": [ "@timestamp", "_document_id", - "user_id", - "operation_type", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "actor", + "user_id", "user_agent", - "request_id", - "action", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8243,18 +12616,30 @@ "description": "A user used their 2FA recovery codes.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "user_agent", - "request_id", - "user", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "created_at", - "@timestamp", - "_document_id", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8262,18 +12647,30 @@ "description": "A user downloaded 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8281,17 +12678,30 @@ "description": "A user printed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", - "user_agent", - "request_id", - "user_id", - "created_at", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8299,18 +12709,30 @@ "description": "A user viewed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", "created_at", - "user", - "operation_type", - "@timestamp", - "request_id", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -8318,17 +12740,30 @@ "description": "A user was prompted for a two-factor authentication code.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", "fields": [ - "user", - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "actor" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" }, @@ -8337,19 +12772,31 @@ "description": "A user was unblocked by another user.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "actor", - "@timestamp", - "user_agent", - "user_id", - "user", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -8357,21 +12804,31 @@ "description": "A user account was unsuspended.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", - "user", "action", - "user_agent", "actor", - "oauth_application_id", - "operation_type", "actor_id", - "created_at", - "@timestamp", - "user_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -8379,21 +12836,33 @@ "description": "A user secret for Codespaces was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8401,46 +12870,64 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", + "operation_type" + ] + }, + { + "action": "workflows.approve_workflow_job", + "description": "A workflow job was approved.", + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" - ] - }, - { - "action": "workflows.approve_workflow_job", - "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", - "fields": [ "user_agent", - "request_id", - "actor", - "actor_id", "workflow_run_id", "run_number", - "user", - "user_id", - "repo", - "repo_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -8449,23 +12936,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8473,23 +12970,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8499,23 +13004,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -8524,22 +13041,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8547,21 +13075,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -8569,25 +13108,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8595,24 +13142,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -8621,25 +13177,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.18/enterprise.json b/src/audit-logs/data/ghes-3.18/enterprise.json index d1f961217c48..c6071acd7121 100644 --- a/src/audit-logs/data/ghes-3.18/enterprise.json +++ b/src/audit-logs/data/ghes-3.18/enterprise.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,17 +67,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "request_id", "@timestamp", - "user_agent", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", - "user_id", + "token_scopes", "user", - "actor", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -61,18 +98,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", + "token_scopes", "user", - "request_id", - "_document_id", - "user_agent", - "actor", "user_id", - "actor_id", - "operation_type", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -80,18 +129,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "actor_id", - "operation_type", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "token_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -99,29 +160,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -129,31 +196,34 @@ "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests", "fields": [ - "user_agent", - "request_id", - "request_method", - "query_string", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", - "request_body", - "status_code", - "url_path", "business", "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "request_method", + "query_string", + "request_body", + "status_code", + "url_path", + "public_repo", "created_at", "operation_type", "route", @@ -167,18 +237,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -186,20 +268,32 @@ "description": "A manual check of the endpoint configured for audit log streaming was performed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "audit_log_stream_result", - "business_id", "business", - "action", - "_document_id", - "@timestamp", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_result", "created_at", "operation_type", - "audit_log_stream_sink_details", - "request_access_security_header" + "audit_log_stream_sink_details" ] }, { @@ -207,18 +301,31 @@ "description": "An endpoint was added for audit log streaming.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "business_id", "business", - "audit_log_stream_sink", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_sink", + "created_at", + "operation_type", "audit_log_stream_id" ] }, @@ -227,15 +334,28 @@ "description": "An audit log streaming endpoint was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "business_id", "business", - "action", - "_document_id", - "@timestamp", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "audit_log_stream_id", @@ -247,17 +367,30 @@ "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "audit_log_stream_enabled", - "business_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_enabled", "audit_log_stream_sink", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "new_s3_bucket", @@ -280,17 +413,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -299,19 +445,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -320,18 +478,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -339,18 +510,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -358,15 +541,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -376,22 +572,31 @@ "description": "An enterprise owner was added to an enterprise.", "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", "fields": [ - "name", - "business", - "user", - "user_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "request_id", + "business", "business_id", - "_document_id", - "user_agent", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "operation_type" ], "docs_reference_titles": "Inviting people to manage your enterprise" }, @@ -400,22 +605,32 @@ "description": "An organization was added to an enterprise.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "operation_type", "name", "created_at", - "request_id", - "_document_id", - "business", - "organization_upgrade", - "request_access_security_header" + "organization_upgrade" ] }, { @@ -423,20 +638,30 @@ "description": "GitHub Advanced Security was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ - "actor", - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -445,17 +670,28 @@ "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -466,21 +702,31 @@ "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -489,17 +735,28 @@ "description": "GitHub Advanced Security was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -510,17 +767,28 @@ "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -531,21 +799,31 @@ "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -554,20 +832,32 @@ "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "new_policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "new_policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -576,20 +866,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -597,17 +899,28 @@ "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -619,21 +932,31 @@ "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -642,18 +965,31 @@ "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -662,17 +998,30 @@ "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", "fields": [ - "name", - "operation_type", - "business_id", - "user_agent", - "actor_id", - "request_id", - "actor", + "@timestamp", "_document_id", - "business", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -682,19 +1031,32 @@ "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", "business_id", - "action", - "_document_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "business", "visibility", "created_at", - "actor", - "operation_type", - "@timestamp" + "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -703,21 +1065,33 @@ "description": "The policy for Code scanning autofix was updated for an enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -725,21 +1099,33 @@ "description": "The policy for Code scanning autofix third party tools was updated for an enterprise.", "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/getting-started/github-security-features#available-with-github-code-security" }, @@ -748,18 +1134,30 @@ "description": "The policy for Code Security enablement was updated for an enterprise.", "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -771,19 +1169,31 @@ "description": "An enterprise was created.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", "_document_id", "action", - "@timestamp", - "request_id", - "name", + "actor", + "actor_id", "business", "business_id", - "operation_type", - "actor", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "name", + "operation_type", + "created_at" ] }, { @@ -791,17 +1201,28 @@ "description": "Dependabot alerts were disabled for new repositories in your enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -811,17 +1232,28 @@ "description": "Dependabot alerts were enabled for new repositories in your enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -831,17 +1263,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -851,18 +1296,30 @@ "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -870,17 +1327,28 @@ "description": "Display of IP addresses within audit log events for the enterprise was disabled.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -891,18 +1359,31 @@ "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.", "docs_reference_links": "N/A", "fields": [ - "action", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "business_id", - "actor_id", - "name", - "_document_id", - "request_id" + "name" ] }, { @@ -910,15 +1391,28 @@ "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -928,17 +1422,28 @@ "description": "Display of IP addresses within audit log events for the enterprise was enabled.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -949,18 +1454,31 @@ "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "operation_type", - "created_at", + "actor_id", "business", "business_id", - "name", - "_document_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "name" ] }, { @@ -968,20 +1486,31 @@ "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", "actor_id", - "@timestamp", - "request_id", "business", - "name", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "business_id", - "_document_id" + "created_at", + "name", + "operation_type" ] }, { @@ -989,20 +1518,31 @@ "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1010,20 +1550,31 @@ "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "name", - "actor", - "operation_type", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "business", - "actor_id", - "created_at", - "action", + "user_id", "user_agent", - "request_id", - "user_id" + "name", + "operation_type", + "created_at" ] }, { @@ -1031,20 +1582,31 @@ "description": "An enterprise owner was removed from an enterprise.", "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", - "user_agent", + "actor_id", "business", "business_id", - "@timestamp", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "name", - "actor_id", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", - "user" + "user_agent", + "operation_type", + "created_at", + "name" ], "docs_reference_titles": "Inviting people to manage your enterprise" }, @@ -1053,20 +1615,31 @@ "description": "An organization was removed from an enterprise.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "business", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "business_id", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "name", - "org" + "name" ] }, { @@ -1074,18 +1647,31 @@ "description": "The slug for the enterprise URL was renamed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "name", - "business_id", - "user_agent", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", - "@timestamp", - "created_at", + "actor_id", "business", - "_document_id" + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ] }, { @@ -1093,20 +1679,31 @@ "description": "The SAML single sign-on session for a member in an enterprise was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", - "user_agent", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "actor", - "_document_id", - "actor_id", "name", - "@timestamp", - "user_id", - "action", - "created_at", - "business" + "created_at" ] }, { @@ -1114,17 +1711,28 @@ "description": "Automatic partner validation checks have been disabled at the business level", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1135,17 +1743,28 @@ "description": "Automatic partner validation checks have been enabled at the business level", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1156,20 +1775,30 @@ "description": "An enterprise-level custom pattern was created for secret scanning.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -1178,17 +1807,28 @@ "description": "An enterprise-level custom pattern was removed from secret scanning.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1198,20 +1838,30 @@ "description": "An enterprise-level custom pattern was published for secret scanning.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1219,17 +1869,28 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1240,20 +1901,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -1262,17 +1933,28 @@ "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1282,17 +1964,28 @@ "description": "Secret scanning was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1303,17 +1996,28 @@ "description": "Secret scanning was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1324,17 +2028,28 @@ "description": "Secret scanning was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1345,17 +2060,28 @@ "description": "Secret scanning was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1366,17 +2092,28 @@ "description": "Secret scanning for non-provider patterns was disabled at the enterprise level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1388,17 +2125,28 @@ "description": "Secret scanning for non-provider patterns was enabled at the enterprise level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1410,17 +2158,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1431,17 +2190,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1452,17 +2222,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1473,17 +2254,28 @@ "description": "Push protection for secret scanning was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1494,17 +2286,28 @@ "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -1515,17 +2318,28 @@ "description": "Push protection for secret scanning was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1536,17 +2350,28 @@ "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1557,20 +2382,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1578,26 +2415,36 @@ "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1605,24 +2452,34 @@ "description": "A CSV export was requested on the \"Coverage\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1630,26 +2487,36 @@ "description": "A CSV export was requested on the \"Overview Dashboard\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1657,20 +2524,31 @@ "description": "A CSV export was requested on the \"Risk\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1681,17 +2559,30 @@ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "created_at", "operation_type" ], @@ -1702,20 +2593,32 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1724,40 +2627,65 @@ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "limit", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { - "action": "business.set_default_workflow_permissions", - "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", - "fields": [ - "actor", - "actor_id", - "user_agent", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", + "limit", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" + }, + { + "action": "business.set_default_workflow_permissions", + "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1766,20 +2694,32 @@ "description": "The policy for fork pull request workflows was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1788,19 +2728,31 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1809,20 +2761,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "issuer", - "name", - "user_agent", - "action", "@timestamp", "_document_id", + "action", "actor", + "actor_id", "business", "business_id", - "actor_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "issuer", + "name", + "created_at", + "operation_type" ] }, { @@ -1830,18 +2794,31 @@ "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "updated_github_owned_allowed", "updated_verified_allowed", "updated_patterns", @@ -1856,20 +2833,33 @@ "description": "The base repository permission setting was updated for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", "fields": [ - "business_id", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "permission", - "action", "created_at", - "@timestamp", - "request_id", "name", - "_document_id", - "old_permission", - "business" + "old_permission" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -1878,19 +2868,32 @@ "description": "The repository creation setting was updated for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation", "fields": [ - "created_at", + "@timestamp", "_document_id", - "request_id", - "name", - "business_id", + "action", "actor", "actor_id", - "@timestamp", - "operation_type", - "permission", - "action", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "name", + "operation_type", + "permission", "visibility" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -1900,19 +2903,32 @@ "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories", "fields": [ - "business_id", - "created_at", - "action", - "operation_type", "@timestamp", - "request_id", - "permission", + "_document_id", + "action", "actor", "actor_id", - "name", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "business" + "created_at", + "operation_type", + "permission", + "name" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -1921,20 +2937,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -1943,20 +2970,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -1967,17 +3005,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -1985,15 +3035,31 @@ "description": "Existing code scanning alerts appeared in a branch.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2003,15 +3069,31 @@ "description": "Code scanning alerts were fixed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2021,15 +3103,31 @@ "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_numbers", "commit_oid", - "ref", - "request_id", - "org_id", - "org", - "business_id", - "business" + "ref" ], "docs_reference_titles": "About code scanning" }, @@ -2038,15 +3136,29 @@ "description": "Code scanning alerts were manually dismissed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers", "dismissal_approver_id" ], @@ -2057,19 +3169,31 @@ "description": "Dismissal of code scanning alerts was approved.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2080,19 +3204,31 @@ "description": "Dismissal of code scanning alerts was denied.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2103,19 +3239,31 @@ "description": "Dismissal of code scanning alerts was requested.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2126,13 +3274,31 @@ "description": "Code scanning alerts were seen for the first time.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "commit_oid", - "ref", - "request_id", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", + "commit_oid", + "ref", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2142,15 +3308,31 @@ "description": "Code scanning alerts that were previously fixed reappeared.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2160,15 +3342,29 @@ "description": "Code scanning alerts that were previously dismissed were reopened.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2178,14 +3374,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2195,25 +3406,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -2224,22 +3444,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -2251,22 +3482,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -2275,15 +3517,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -2294,17 +3551,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2314,27 +3584,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", "org", - "owner", - "pull_request_id", - "machine_type", - "user_id", - "user", - "devcontainer_path", - "repo", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "owner", + "pull_request_id", + "machine_type", + "devcontainer_path", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2342,19 +3621,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -2362,18 +3654,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -2382,23 +3686,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2406,16 +3717,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -2424,24 +3749,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2449,15 +3780,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -2467,20 +3811,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2488,19 +3842,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -2508,21 +3874,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -2530,22 +3905,33 @@ "description": "Specific repositories were disabled from using Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "owner_type", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -2553,21 +3939,31 @@ "description": "Specific repositories were enabled to use Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "owner_type", - "owner", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2577,20 +3973,32 @@ "description": "Copilot coding agent access was updated for the organization's or user's repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_access", "old_access", - "org_id", "owner_type", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2600,21 +4008,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2624,19 +4041,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -2646,21 +4072,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2670,18 +4105,31 @@ "description": "A new custom property definition was created.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -2694,18 +4142,31 @@ "description": "A custom property definition was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -2719,14 +4180,29 @@ "description": "A custom property definition was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "value_type", @@ -2739,8 +4215,7 @@ "old_default_value", "old_value_type", "old_values_editable_by", - "values_editable_by", - "request_access_security_header" + "values_editable_by" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2749,27 +4224,35 @@ "description": "A repository's custom property value was manually set for the first time.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "definition_id", - "property_name", - "value", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "definition_id", + "property_name", + "value", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2778,19 +4261,31 @@ "description": "A repository's custom property value was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2799,16 +4294,29 @@ "description": "A repository's custom property value was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "definition_id" @@ -2820,19 +4328,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -2841,19 +4360,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -2862,19 +4392,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -2883,19 +4424,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -2904,21 +4456,31 @@ "description": "The default repository access for Dependabot was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "access_level", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -2927,17 +4489,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2945,19 +4520,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -2966,19 +4552,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2986,19 +4583,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -3007,19 +4615,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -3027,19 +4646,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -3048,19 +4678,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3068,19 +4709,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -3089,20 +4741,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3110,59 +4772,95 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", "created_at", - "user_id", - "@timestamp", "number", - "org", "title", + "operation_type" + ] + }, + { + "action": "discussion_post_reply.destroy", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", "user_agent", "operation_type", - "_document_id" + "number", + "created_at" ] }, { - "action": "discussion_post_reply.destroy", + "action": "discussion_post_reply.update", "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", "@timestamp", - "user_agent", - "operation_type", - "user_id", - "actor", - "number", - "user", - "created_at", - "request_id", - "_document_id" - ] - }, - { - "action": "discussion_post_reply.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "action", "_document_id", - "request_id", - "org", - "@timestamp", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org_id", "user_agent", - "actor", + "operation_type", "number", "team", "created_at" @@ -3173,21 +4871,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "_document_id", - "title", - "user", - "user_agent", - "org", - "operation_type", - "actor_id", "@timestamp", - "actor", - "team", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", + "title", + "operation_type", + "team", "number" ] }, @@ -3196,17 +4905,31 @@ "description": "A global announcement banner was created for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3217,16 +4940,30 @@ "description": "A global announcement banner was removed from the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3237,18 +4974,32 @@ "description": "A global announcement banner was updated for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", "old_message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3259,23 +5010,31 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise" }, @@ -3284,19 +5043,33 @@ "description": "A domain was approved for an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3305,18 +5078,33 @@ "description": "A domain was added to an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3325,18 +5113,33 @@ "description": "A domain was removed from an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3345,18 +5148,33 @@ "description": "A domain was verified for an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3365,18 +5183,30 @@ "description": "A new GitHub Actions self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -3385,20 +5215,30 @@ "description": "A GitHub Actions self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -3407,18 +5247,31 @@ "description": "A GitHub Actions self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows" ], "docs_reference_titles": "Removing self-hosted runners" @@ -3428,18 +5281,31 @@ "description": "A GitHub Actions self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3448,20 +5314,33 @@ "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -3470,19 +5349,31 @@ "description": "A GitHub Actions self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3491,19 +5382,32 @@ "description": "A GitHub Actions runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -3512,24 +5416,36 @@ "description": "The configuration of a GitHub Actions self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3538,14 +5454,32 @@ "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -3554,14 +5488,32 @@ "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -3570,18 +5522,36 @@ "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", "target_version", "runner_group_id", "runner_group_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Self-hosted runners" }, @@ -3590,22 +5560,32 @@ "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "business_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "user", - "business", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3613,21 +5593,33 @@ "description": "A license for GitHub Copilot was assigned to an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3635,17 +5627,30 @@ "description": "A license for GitHub Copilot was unassigned from an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3656,17 +5661,30 @@ "description": "A new enterprise team was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3676,17 +5694,30 @@ "description": "An enterprise team was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3697,22 +5728,32 @@ "description": "A member was removed from the enterprise team or an IdP group linked to an enterprise team, or an IdP group was unlinked from an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "business_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "user", - "business", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3720,18 +5761,31 @@ "description": "The name of an enterprise team was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "business_id", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3742,46 +5796,65 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.create", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Managing environments for deployment" + }, + { + "action": "environment.create", "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3789,28 +5862,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3819,27 +5898,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -3848,25 +5935,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3875,26 +5970,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3903,21 +6005,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -3926,22 +6040,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -3950,49 +6074,70 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "public_repo", "programmatic_access_type", - "request_access_security_header" - ], - "docs_reference_titles": "Managing environments for deployment" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "visibility", + "operation_type", + "created_at", + "public_repo" + ], + "docs_reference_titles": "Managing environments for deployment" }, { "action": "environment.update_actions_variable", "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -4001,21 +6146,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -4026,27 +6181,33 @@ "description": "A user was added to an external group.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "external_group", - "external_group_id", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "external_group", + "external_group_id", "created_at", "operation_type", - "business", - "business_id", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -4054,19 +6215,31 @@ "description": "An external group was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at", "scim_group_id" ] }, @@ -4075,22 +6248,33 @@ "description": "An external group was linked to a GitHub team.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "external_group", - "programmatic_access_type", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -4098,21 +6282,31 @@ "description": "An external group was created.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -4120,26 +6314,32 @@ "description": "A user was removed from an external group.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "external_group", - "external_group_id", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "external_group", + "external_group_id", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -4147,15 +6347,29 @@ "description": "Failed external group SCIM API request.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", @@ -4163,15 +6377,9 @@ "url_path", "scim_group_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4180,30 +6388,38 @@ "description": "Successful external group SCIM API request. Excludes GET API requests.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", "status_code", "url_path", "scim_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4212,18 +6428,31 @@ "description": "An external group was unlinked to a GitHub team.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "external_group" ] }, @@ -4232,22 +6461,32 @@ "description": "An external group was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "scim_group_id", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at", + "scim_group_id" ] }, { @@ -4255,25 +6494,33 @@ "description": "An external group's display name was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", "external_group", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -4281,20 +6528,31 @@ "description": "An external identity was deprovisioned, suspending the linked GitHub user.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -4302,17 +6560,31 @@ "description": "An external identity was created and linked to a GitHub user.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "scim_user_id", - "request_access_security_header" + "scim_user_id" ] }, { @@ -4320,15 +6592,29 @@ "description": "Failed external identity SCIM API request.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", @@ -4336,15 +6622,9 @@ "url_path", "scim_user_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4353,30 +6633,38 @@ "description": "Successful external identity SCIM API request. Excludes GET API requests.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", "status_code", "url_path", "scim_user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4385,18 +6673,31 @@ "description": "An external identity was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "scim_user_id", - "request_access_security_header" + "scim_user_id" ] }, { @@ -4404,21 +6705,32 @@ "description": "A gist was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "gist_id", - "@timestamp", "created_at", "operation_type", - "user_agent", - "actor", - "actor_id", - "visibility", - "action", - "_document_id", - "token_scopes", - "programmatic_access_type" + "visibility" ] }, { @@ -4426,20 +6738,32 @@ "description": "A gist was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "gist_id", - "visibility", - "created_at", + "@timestamp", "_document_id", - "user", - "request_id", - "operation_type", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "@timestamp", - "programmatic_access_type" + "gist_id", + "visibility", + "created_at", + "operation_type" ] }, { @@ -4447,21 +6771,32 @@ "description": "The visibility of a gist was updated.", "docs_reference_links": "N/A", "fields": [ - "action", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", - "user", - "gist_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "visibility", - "user_id", - "created_at", - "_document_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "gist_id", + "visibility", + "created_at" ] }, { @@ -4469,19 +6804,30 @@ "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4490,20 +6836,30 @@ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4512,19 +6868,30 @@ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4533,22 +6900,33 @@ "description": "An SSH key was added to a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -4557,23 +6935,34 @@ "description": "An SSH key was removed from a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", "explanation", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -4582,23 +6971,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4606,18 +7004,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor", - "actor_id", - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -4628,20 +7036,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -4651,18 +7069,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "created_at", - "user_id", "@timestamp", - "user", - "operation_type", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -4670,18 +7100,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "created_at", - "_document_id", + "user_id", "user_agent", - "@timestamp", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -4689,25 +7131,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -4715,25 +7167,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -4741,26 +7202,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -4769,25 +7239,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -4795,26 +7274,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -4822,21 +7310,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -4845,19 +7344,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -4865,21 +7377,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -4888,19 +7411,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -4911,20 +7448,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -4934,24 +7483,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -4962,23 +7522,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -4989,21 +7561,33 @@ "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", "operation_type", - "@timestamp", "integration", - "action", - "user_agent", "reason", - "_document_id", - "org", - "org_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -5014,20 +7598,32 @@ "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ "@timestamp", - "actor_id", - "org", "_document_id", - "requester", "action", - "user_agent", - "created_at", - "url", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "requester", + "created_at", + "url", + "operation_type", "integration", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -5037,20 +7633,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -5060,19 +7669,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -5081,20 +7704,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -5104,20 +7740,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -5126,20 +7775,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -5148,20 +7810,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -5169,19 +7843,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -5190,19 +7877,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -5211,17 +7911,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -5234,21 +7947,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -5262,17 +7988,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -5284,19 +8023,30 @@ "description": "An IP allow list was disabled.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "actor", - "request_id", - "org", - "user_agent", + "@timestamp", "_document_id", - "user_id", + "action", + "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "@timestamp", - "user" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5304,19 +8054,30 @@ "description": "An IP allow list was disabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5324,17 +8085,28 @@ "description": "IP allow list user level enforcement was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5344,20 +8116,29 @@ "description": "An IP allow list was enabled.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "user_id", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "business_id", - "_document_id", - "action", - "@timestamp", + "user_id", "user_agent", - "actor_id", "operation_type", - "org", "created_at" ] }, @@ -5366,19 +8147,30 @@ "description": "An IP allow list was enabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5386,17 +8178,28 @@ "description": "IP allow list user level enforcement was enabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5406,24 +8209,32 @@ "description": "An IP address was added to an IP allow list.", "docs_reference_links": "N/A", "fields": [ - "active", - "org", - "ip_allow_list_entry", "@timestamp", "_document_id", - "operation_type", - "created_at", - "user_agent", "action", - "request_id", + "actor", "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "business", - "actor", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", + "ip_allow_list_entry", + "operation_type", + "created_at" ] }, { @@ -5431,24 +8242,32 @@ "description": "An IP address was deleted from an IP allow list.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "ip_allow_list_entry", - "org", - "operation_type", - "created_at", - "active", "action", - "@timestamp", + "actor", + "actor_id", "business", "business_id", - "user_agent", + "hashed_token", + "org", "org_id", - "actor", - "actor_id", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ip_allow_list_entry", + "operation_type", + "created_at", + "active" ] }, { @@ -5456,19 +8275,32 @@ "description": "An IP address or its description was changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "actor_id", "ip_allow_list_entry", - "active", - "org_id", - "@timestamp" + "active" ] }, { @@ -5476,18 +8308,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5495,21 +8339,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -5517,21 +8374,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -5539,22 +8409,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -5562,19 +8445,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -5585,21 +8481,36 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "actor", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", "marketplace_listing", "has_free_trial", - "user_agent", - "request_id", - "actor_id", "yearly_price_in_cents", "description", "bullets", "monthly_price_in_cents", - "marketplace_listing_plan", - "_document_id" + "marketplace_listing_plan" ] }, { @@ -5607,22 +8518,37 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "marketplace_listing_plan", "marketplace_listing", "description", "bullets", "has_free_trial", "created_at", - "actor_id", "operation_type", - "_document_id", - "action", - "user_agent", - "request_id", - "actor", "monthly_price_in_cents", - "yearly_price_in_cents", - "@timestamp" + "yearly_price_in_cents" ] }, { @@ -5630,21 +8556,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor", - "marketplace_listing_plan", - "_document_id", - "request_id", - "description", - "yearly_price_in_cents", "@timestamp", - "created_at", - "actor_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "marketplace_listing_plan", + "description", + "yearly_price_in_cents", + "created_at", "bullets", "has_free_trial", "marketplace_listing", - "user_agent", "monthly_price_in_cents", - "action", "operation_type" ] }, @@ -5653,21 +8594,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "monthly_price_in_cents", - "marketplace_listing", + "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "monthly_price_in_cents", + "marketplace_listing", "description", "bullets", "yearly_price_in_cents", - "request_id", - "actor_id", "has_free_trial", "marketplace_listing_plan", - "user_agent", - "@timestamp", "operation_type", - "actor", "created_at" ] }, @@ -5676,22 +8632,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -5699,22 +8668,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -5722,19 +8704,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5742,21 +8736,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5766,16 +8769,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5785,18 +8801,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5806,14 +8835,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -5821,19 +8866,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5841,18 +8897,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5860,23 +8928,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -5884,20 +8960,30 @@ "description": "An OAuth access token was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", "fields": [ - "_document_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "user", - "user_id", - "created_at", + "_document_id", "action", + "actor", "actor_id", - "request_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" @@ -5908,19 +8994,30 @@ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", "fields": [ "@timestamp", - "user_agent", - "action", - "operation_type", "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_id", + "user_agent", + "operation_type", + "created_at", "explanation", - "hashed_token", - "actor_id", - "token_scopes", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" @@ -5930,19 +9027,30 @@ "description": "An OAuth access token was regenerated.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "_document_id", - "created_at", "@timestamp", - "operation_type", + "_document_id", "action", - "user_agent", - "request_id", "actor", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "oauth_application_name" ] }, @@ -5951,16 +9059,28 @@ "description": "An OAuth access token was revoked.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "request_access_security_header", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -5970,18 +9090,30 @@ "description": "An OAuth access token was updated.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -5989,20 +9121,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6011,42 +9155,66 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" + ], + "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6055,20 +9223,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6077,19 +9257,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6098,20 +9291,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6120,20 +9325,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6143,18 +9360,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user_agent", - "org_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "oauth_application_id", - "action", "created_at", - "actor", - "actor_id", - "oauth_application", - "_document_id", - "request_id" + "oauth_application" ] }, { @@ -6162,19 +9392,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6183,15 +9426,32 @@ "description": "An OAuth application was unsuspended for a user or organization account.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "operation_type", - "org_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "oauth_application_id", "oauth_application", - "org", - "created_at", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6200,26 +9460,33 @@ "description": "An authorization for an OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ - "operation_type", - "user_agent", - "user_id", - "actor", - "org_id", + "@timestamp", "_document_id", - "request_id", "action", - "@timestamp", - "created_at", + "actor", "actor_id", - "user", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "oauth_application_name" - ], + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_is_bot", + "oauth_application_name" + ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" }, { @@ -6227,20 +9494,31 @@ "description": "An authorization for an OAuth application was deleted.", "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", "fields": [ - "user_agent", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "actor", "created_at", "explanation", - "user", - "user_id", - "org_id", - "action", - "actor_id", - "token_scopes", "actor_is_bot", "oauth_application_name" ], @@ -6251,20 +9529,31 @@ "description": "An authorization for an OAuth application was updated.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", - "actor_id", "user_agent", - "@timestamp", "operation_type", - "action", - "user", "created_at", - "_document_id", "actor_is_bot", - "request_access_security_header", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -6274,17 +9563,28 @@ "description": "An invitation sent to an organization to join an enterprise was accepted.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6295,20 +9595,30 @@ "description": "A billing manager was added to an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "org", - "user_id", "action", - "created_at", - "org_id", - "user", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" }, @@ -6317,21 +9627,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -6340,24 +9660,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -6365,21 +9695,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -6387,20 +9727,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -6408,43 +9758,61 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "user", - "user_id", - "org", - "org_id", - "business", - "business_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", - "token_scopes" - ] - }, - { - "action": "org.advanced_security_enabled_for_new_repos", - "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "org.advanced_security_enabled_for_new_repos", + "description": "GitHub Advanced Security was enabled for new repositories in an organization.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6452,22 +9820,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -6475,21 +9851,31 @@ "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "new_policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "new_policy", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -6499,19 +9885,30 @@ "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -6520,19 +9917,30 @@ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -6542,16 +9950,29 @@ "description": "A user initiated a background job to delete an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "@timestamp", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "created_at" ] }, @@ -6560,16 +9981,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_agent", - "action", "@timestamp", - "actor_id", - "org_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -6578,18 +10012,31 @@ "description": "An organization owner blocked a user from accessing the organization's repositories.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", "fields": [ - "actor", - "user_agent", - "org_id", - "created_at", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "blocked_user", + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" }, @@ -6598,19 +10045,30 @@ "description": "An invitation for an organization to join an enterprise was revoked", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "initiated_from" ], "docs_reference_titles": "Adding organizations to your enterprise" @@ -6620,22 +10078,33 @@ "description": "An invitation sent to a user to join an organization was revoked.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "org_id", - "request_id", - "email", "@timestamp", - "actor", + "_document_id", "action", - "operation_type", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "email", + "operation_type", "invitation_id", - "_document_id", "created_at", - "invitee_email", - "token_scopes", - "programmatic_access_type" + "invitee_email" ] }, { @@ -6643,19 +10112,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -6663,23 +10143,31 @@ "description": "Autofix for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6687,21 +10175,31 @@ "description": "Autofix for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6709,23 +10207,31 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6733,23 +10239,31 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6757,21 +10271,30 @@ "description": "Code scanning using the default setup was disabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -6780,21 +10303,30 @@ "description": "Code scanning using the default setup was enabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -6803,16 +10335,29 @@ "description": "The interaction limit for collaborators only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "request_id", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" @@ -6822,17 +10367,30 @@ "description": "The interaction limit for prior contributors only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "operation_type", "@timestamp", - "created_at", - "user_agent", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", - "actor", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6841,17 +10399,30 @@ "description": "The interaction limit for existing users only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", "_document_id", - "operation_type", - "actor_id", - "org_id", "action", - "created_at", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6861,16 +10432,29 @@ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ "@timestamp", - "created_at", "_document_id", - "actor_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "action", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6879,17 +10463,30 @@ "description": "The interaction limit for prior contributors only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "operation_type", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6898,17 +10495,30 @@ "description": "The interaction limit for existing users only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "actor_id", - "request_id", + "@timestamp", + "_document_id", "action", - "created_at", - "user_agent", "actor", - "_document_id", - "org_id", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -6917,22 +10527,30 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" }, @@ -6941,17 +10559,28 @@ "description": "An invitation for an organization to join an enterprise was confirmed.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6962,18 +10591,30 @@ "description": "An organization was created.", "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", "fields": [ - "request_id", - "org", - "actor_id", - "actor", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "org_id", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" }, @@ -6982,18 +10623,30 @@ "description": "An organization was deleted by a user or staff.", "docs_reference_links": "N/A", "fields": [ - "user_agent", "@timestamp", "_document_id", - "created_at", - "actor", - "org_id", - "org", "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7001,20 +10654,30 @@ "description": "Team creation was limited to owners.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "actor", "@timestamp", "_document_id", - "user", - "user_id", "action", - "created_at", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -7023,19 +10686,30 @@ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -7044,14 +10718,31 @@ "description": "SAML single sign-on was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "sso_url", - "issuer", - "action", "@timestamp", "_document_id", - "created_at", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "issuer", + "created_at", "operation_type" ] }, @@ -7060,17 +10751,30 @@ "description": "A two-factor authentication requirement was disabled for the organization.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "org_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "_document_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7078,19 +10782,30 @@ "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "user", - "action", - "operation_type", "@timestamp", "_document_id", - "created_at", - "user_agent", - "org", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7098,19 +10813,30 @@ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "user", - "action", - "actor_id", - "org_id" + "created_at" ] }, { @@ -7118,19 +10844,30 @@ "description": "Team creation by members was allowed.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "org_id", - "user", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -7139,19 +10876,30 @@ "description": "An organization owner allowed users with read access to create discussions in an organization", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -7160,19 +10908,32 @@ "description": "SAML single sign-on was enabled for the organization.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", - "sso_url", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "@timestamp", - "issuer", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "sso_url", + "created_at", + "issuer" ], "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" }, @@ -7181,17 +10942,30 @@ "description": "Two-factor authentication is now required for the organization.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "actor_id", - "action", - "_document_id", - "org", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" }, @@ -7200,17 +10974,30 @@ "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "org_id", - "manager", "@timestamp", - "request_id", - "actor", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "manager", + "operation_type", "created_at" ] }, @@ -7219,42 +11006,64 @@ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", "docs_reference_links": "N/A", "fields": [ - "org_id", "@timestamp", - "org", - "user_agent", - "request_id", + "_document_id", "action", "actor", "actor_id", - "manager", - "operation_type", - "created_at", - "_document_id" - ] - }, - { - "action": "org.invite_member", - "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", - "fields": [ + "business", + "business_id", + "hashed_token", "org", - "user_id", - "invitation_id", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", + "user_agent", + "manager", "operation_type", + "created_at" + ] + }, + { + "action": "org.invite_member", + "description": "A new user was invited to join an organization.", + "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", + "fields": [ + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", - "created_at", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "invitee_email", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitation_id", + "operation_type", + "created_at", + "invitee_email" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" }, @@ -7263,17 +11072,28 @@ "description": "An organization was invited to join an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7283,19 +11103,30 @@ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7303,19 +11134,30 @@ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "org", - "org_id", - "user_agent", - "actor_id", - "user_id", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7324,16 +11166,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "org_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type", - "_document_id", - "org" + "created_at", + "operation_type" ] }, { @@ -7341,17 +11196,30 @@ "description": "An organization was restored.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "org_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7359,19 +11227,31 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", "fields": [ - "actor", - "operation_type", "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "actor_is_bot", - "request_access_security_header" + "operation_type", + "created_at", + "actor_is_bot" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -7380,18 +11260,29 @@ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "user_id", - "user_agent", - "org_id", - "user", - "action", - "_document_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" @@ -7401,21 +11292,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7423,21 +11323,30 @@ "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ - "org", - "user", - "org_id", - "created_at", - "request_id", "@timestamp", - "action", - "operation_type", - "user_agent", "_document_id", + "action", "actor", "actor_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7445,21 +11354,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -7467,18 +11386,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", "fields": [ - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "actor", - "action", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -7487,19 +11418,31 @@ "description": "An organization was renamed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "_document_id", "@timestamp", - "org", + "_document_id", "action", "actor", - "old_login", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_login", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -7507,20 +11450,30 @@ "description": "An organization member was restored.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", "fields": [ - "user", - "actor", - "user_id", + "@timestamp", "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "actor_id", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" }, @@ -7529,21 +11482,33 @@ "description": "A self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" @@ -7553,21 +11518,31 @@ "description": "A self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7576,23 +11551,33 @@ "description": "The REST API was used to remove a self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -7601,23 +11586,31 @@ "description": "A self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7626,19 +11619,32 @@ "description": "A runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "runner_group_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -7647,25 +11653,36 @@ "description": "The configuration of a self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7674,21 +11691,30 @@ "description": "Automatic partner validation checks have been disabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -7698,21 +11724,30 @@ "description": "Automatic partner validation checks have been enabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -7722,20 +11757,30 @@ "description": "A custom pattern was created for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7744,22 +11789,30 @@ "description": "A custom pattern was removed from secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7768,21 +11821,30 @@ "description": "A custom pattern was published for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7791,21 +11853,30 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7814,22 +11885,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7838,21 +11917,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "business", - "business_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7861,21 +11949,30 @@ "description": "Secret scanning for non-provider patterns was disabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7885,21 +11982,30 @@ "description": "Secret scanning for non-provider patterns was enabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7909,19 +12015,30 @@ "description": "A role or team was added to the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7931,21 +12048,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7955,21 +12081,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7979,19 +12114,30 @@ "description": "A role or team was removed from the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -8001,22 +12147,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8025,22 +12179,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8049,22 +12211,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8073,21 +12243,30 @@ "description": "Push protection for secret scanning was disabled.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8096,21 +12275,30 @@ "description": "Push protection for secret scanning was enabled.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8119,22 +12307,30 @@ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8143,22 +12339,30 @@ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8167,26 +12371,35 @@ "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -8195,26 +12408,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8222,28 +12443,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8251,26 +12480,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8278,15 +12515,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -8295,26 +12549,64 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", - "org", - "runner_id", - "runner_name", - "action", + "@timestamp", "_document_id", - "operation_type", - "created_at", - "@timestamp" - ], - "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" - }, - { - "action": "org.self_hosted_runner_updated", - "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", - "fields": [ - "org_id", - "runner_id", - "runner_name", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_id", + "runner_name", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" + }, + { + "action": "org.self_hosted_runner_updated", + "description": "The runner application was updated. This event is not included in the JSON/CSV export.", + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_id", + "runner_name", "source_version", "target_version", "runner_group_id", @@ -8327,20 +12619,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -8349,16 +12652,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -8369,18 +12685,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -8389,17 +12718,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", "_document_id", - "org_id", - "operation_type", + "action", "actor", "actor_id", - "@timestamp", - "request_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", - "action" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8407,18 +12749,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -8427,18 +12781,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -8447,18 +12814,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -8467,42 +12846,64 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", "actor_id", - "org_id", - "@timestamp", - "org", - "issuer", "business", - "operation_type", - "created_at", - "request_id", "business_id", - "_document_id", - "actor_is_bot", - "request_access_security_header" - ] - }, - { - "action": "org.transform", - "description": "A user account was converted into an organization.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization", - "fields": [ - "actor", - "_document_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "issuer", "operation_type", + "created_at", + "actor_is_bot" + ] + }, + { + "action": "org.transform", + "description": "A user account was converted into an organization.", + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "@timestamp", - "created_at", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "owner", - "request_access_security_header" + "operation_type", + "created_at", + "owner" ], "docs_reference_titles": "Converting a user into an organization" }, @@ -8511,19 +12912,32 @@ "description": "A user was unblocked from an organization.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", "fields": [ - "oauth_application_id", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", - "@timestamp", - "request_id", - "created_at", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "blocked_user", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" }, @@ -8532,23 +12946,34 @@ "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "updated_allowed_types", "old_policy", - "updated_access_policy", - "programmatic_access_type", - "request_access_security_header" + "updated_access_policy" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" }, @@ -8557,20 +12982,32 @@ "description": "The default repository permission level for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", + "created_at", "permission", - "actor_id", - "old_permission", - "_document_id", - "programmatic_access_type" + "old_permission" ] }, { @@ -8579,20 +13016,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -8600,17 +13048,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -8620,20 +13081,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -8642,19 +13114,32 @@ "description": "An organization's SAML provider settings were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "sso_url", - "actor_id", - "operation_type", "@timestamp", - "issuer", - "org", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "operation_type", + "issuer", + "created_at" ] }, { @@ -8662,19 +13147,31 @@ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", "fields": [ - "request_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "operation_type", - "_document_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "@timestamp", - "created_at", - "request_access_security_header" - ], + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" }, { @@ -8682,20 +13179,33 @@ "description": "A domain was approved for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "org_id", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" }, @@ -8704,16 +13214,31 @@ "description": "A domain was added to an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "created_at", + "@timestamp", "_document_id", - "domain_name", "action", - "request_id", + "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "domain_name", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8722,14 +13247,29 @@ "description": "A domain was removed from an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", "fields": [ - "action", - "domain_name", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "domain_name", "operation_type", "created_at" ], @@ -8740,16 +13280,31 @@ "description": "A domain was verified for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "operation_type", - "domain_name", "@timestamp", - "user_agent", - "request_id", - "actor", - "action", - "created_at", "_document_id", - "actor_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "domain_name", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8758,20 +13313,31 @@ "description": "An entire package was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" @@ -8781,23 +13347,34 @@ "description": "A package was published or republished to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "ecosystem", "version_count", "is_republished", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -8806,21 +13383,32 @@ "description": "A specific package version was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "version", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "ecosystem", "actor_is_bot" ], @@ -8831,21 +13419,34 @@ "description": "A specific package version was published or republished to a package.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "ecosystem", "package", "version", - "actor_id", - "user_agent", "is_republished", - "actor", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -8854,20 +13455,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -8876,17 +13491,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", - "owner_type", - "domain", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", + "owner_type", + "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8897,20 +13527,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -8919,19 +13563,31 @@ "description": "A new passkey was added.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8939,19 +13595,31 @@ "description": "A new passkey was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8959,18 +13627,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8978,16 +13658,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8995,18 +13689,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -9014,18 +13720,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9036,22 +13755,31 @@ "description": "The configured restriction for access to resources via personal access tokens was disabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9059,22 +13787,31 @@ "description": "The configured restriction for access to resources via personal access tokens was enabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9082,18 +13819,28 @@ "description": "The configured restriction for access to resources via personal access tokens was reset and delegated to organizations.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9104,18 +13851,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9126,18 +13886,28 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9148,18 +13918,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9170,18 +13950,28 @@ "description": "Triggered when the enterprise delegates to the organizations when to require approval for fine-grained personal access tokens before the tokens can access organization resources.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9192,17 +13982,30 @@ "description": "Triggered when you create a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9212,19 +14015,31 @@ "description": "Triggered when you regenerate a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9232,12 +14047,29 @@ "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", "fields": [ - "user_programmatic_access_name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", "operation_type" ], @@ -9248,20 +14080,32 @@ "description": "Triggered when you delete a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "explanation", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9269,23 +14113,34 @@ "description": "A personal access token expiration limit was set.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "token_expiration", "old_token_expiration", "exempt_administrators", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9293,21 +14148,32 @@ "description": "A personal access token expiration limit was unset.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "programmatic_access_type", - "old_token_expiration", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_token_expiration", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9315,17 +14181,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9336,18 +14215,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9359,17 +14251,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9381,17 +14286,30 @@ "description": "A fine-grained personal access token was updated.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9402,15 +14320,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9420,17 +14353,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -9440,15 +14384,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9458,17 +14417,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9478,17 +14448,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9498,17 +14479,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9518,17 +14510,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9538,17 +14541,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -9558,17 +14574,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9576,20 +14605,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -9599,25 +14639,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -9625,20 +14677,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9646,25 +14710,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9672,17 +14748,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -9690,17 +14779,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -9708,18 +14810,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -9728,18 +14842,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -9748,19 +14874,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -9768,17 +14905,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -9790,22 +14940,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -9813,19 +14972,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -9833,17 +15003,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9851,18 +15034,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -9870,20 +15066,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9891,18 +15097,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -9911,18 +15129,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -9931,16 +15161,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -9952,21 +15195,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -9974,22 +15229,32 @@ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", "fields": [ - "repo", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "name", "created_at", - "_document_id", "operation_type", - "actor", - "repo_id", - "org", - "request_id", - "actor_id", - "oauth_application_id", - "@timestamp", - "programmatic_access_type" + "oauth_application_id" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" }, @@ -9998,29 +15263,34 @@ "description": "A protected branch allowance was given to a specific user, team or integration.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "authorized_actors", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -10028,24 +15298,32 @@ "description": "Branch protection was enabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "repo_id", - "user_id", "@timestamp", - "user_agent", - "repo", - "name", - "org_id", - "user", "_document_id", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", "created_at", "authorized_actor_names", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -10056,21 +15334,31 @@ "description": "Branch protection was disabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "repo", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", - "request_id", - "repo_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "name", + "operation_type", "created_at", - "_document_id", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -10081,22 +15369,32 @@ "description": "Enforcement of dismissing stale pull requests was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "dismiss_stale_reviews_on_push", - "org_id", - "action", - "created_at", - "request_id", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismiss_stale_reviews_on_push", + "created_at", "operation_type", - "actor", - "repo", - "org", - "name", - "programmatic_access_type" + "name" ] }, { @@ -10104,24 +15402,34 @@ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "authorized_actors_only", "authorized_actors", "created_at", - "user_agent", "name", - "_document_id", - "org_id", - "request_id", - "@timestamp", - "actor_id", - "org", - "action", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -10129,30 +15437,37 @@ "description": "A branch protection requirement was overridden by a repository administrator.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "actor", "reasons", - "@timestamp", "before", "after", - "actor_id", - "repo", "operation_type", - "user_agent", "branch", "overridden_codes", - "org", - "org_id", - "action", - "_document_id", - "request_id", "referrer", - "business", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "rule_suite_id" ] @@ -10162,28 +15477,36 @@ "description": "A branch update attempt was rejected.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "request_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "branch", "before", "overridden_codes", "after", - "action", "reasons", - "actor_id", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "actor_is_bot", "rule_suite_id" @@ -10194,23 +15517,32 @@ "description": "Branch protection was enforced for repository administrators.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "admin_enforced", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "name", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "action", "repo_id", - "org_id", - "_document_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "admin_enforced", + "operation_type", + "name", + "created_at" ] }, { @@ -10218,22 +15550,32 @@ "description": "Branch deletion was enabled or disabled for a protected branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "operation_type", - "request_id", - "repo", "@timestamp", - "org_id", - "org", - "action", - "allow_deletions_enforcement_level", "_document_id", - "created_at", - "actor_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_deletions_enforcement_level", + "created_at" ] }, { @@ -10241,23 +15583,32 @@ "description": "Force pushes were enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "actor_id", - "name", + "@timestamp", "_document_id", + "action", "actor", - "repo", - "operation_type", - "request_id", - "allow_force_pushes_enforcement_level", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_force_pushes_enforcement_level", + "created_at" ] }, { @@ -10265,24 +15616,33 @@ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "ignore_approvals_from_contributors", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -10291,22 +15651,32 @@ "description": "Required linear commit history was enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "operation_type", "actor", - "linear_history_requirement_enforcement_level", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "linear_history_requirement_enforcement_level", "name", - "org_id", - "repo_id", - "org", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ] }, { @@ -10314,24 +15684,33 @@ "description": "Fork syncing was enabled or disabled for a read-only branch", "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "lock_allows_fetch_and_merge", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "lock_allows_fetch_and_merge", + "public_repo", + "created_at", + "operation_type" ], "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -10340,27 +15719,34 @@ "description": "The enforcement of a branch lock was updated.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "enforcement_level", "lock_branch_enforcement_level", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -10369,18 +15755,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -10391,24 +15790,33 @@ "description": "A branch name pattern was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "old_name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "old_name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -10416,25 +15824,32 @@ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", "docs_reference_links": "N/A", "fields": [ - "name", - "org_id", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "@timestamp", + "business", "business_id", - "request_id", - "pull_request_reviews_enforcement_level", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "business", - "user_agent", - "created_at", "repo_id", - "operation_type", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "pull_request_reviews_enforcement_level", + "created_at", + "operation_type" ] }, { @@ -10442,22 +15857,32 @@ "description": "Enforcement of required code owner review was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "created_at", - "require_code_owner_review", - "operation_type", - "name", - "user_agent", - "action", "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "request_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "require_code_owner_review", + "operation_type", + "name" ] }, { @@ -10465,22 +15890,33 @@ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "require_last_push_approval", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" }, @@ -10489,22 +15925,32 @@ "description": "Enforcement of the required number of approvals before merging was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "required_approving_review_count", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "required_approving_review_count", "created_at", - "actor", "operation_type", - "user_agent", - "name", - "org_id", - "action", - "actor_id", - "_document_id", - "org", - "@timestamp", - "programmatic_access_type" + "name" ] }, { @@ -10512,48 +15958,65 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "user_agent", "@timestamp", "_document_id", - "name", - "repo", "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "business", - "actor_id", - "operation_type", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "required_status_checks_enforcement_level", - "org", + "token_id", "token_scopes", - "programmatic_access_type" - ] - }, - { - "action": "protected_branch.update_signature_requirement_enforcement_level", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "required_status_checks_enforcement_level" + ] + }, + { + "action": "protected_branch.update_signature_requirement_enforcement_level", "description": "Enforcement of required commit signing was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "name", "@timestamp", - "created_at", "_document_id", - "request_id", - "repo_id", - "org", - "org_id", "action", "actor", "actor_id", - "signature_requirement_enforcement_level", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "programmatic_access_type" + "operation_type", + "name", + "created_at", + "signature_requirement_enforcement_level" ] }, { @@ -10561,22 +16024,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "created_at", - "repo_id", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "name", - "actor", - "repo", "operation_type", - "action", - "strict_required_status_checks_policy", - "programmatic_access_type" + "strict_required_status_checks_policy" ] }, { @@ -10584,23 +16057,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -10609,24 +16093,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -10635,20 +16130,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10657,21 +16166,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -10681,22 +16203,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10705,25 +16239,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10732,23 +16276,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", - "created_at", - "key", - "fingerprint", - "actor_id", "actor", - "title", - "user_agent", - "user_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "read_only", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "key", + "fingerprint", + "title", + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10757,18 +16312,32 @@ "description": "A pull request was closed without being merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" @@ -10778,21 +16347,32 @@ "description": "A pull request was converted to a draft.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" }, @@ -10801,19 +16381,32 @@ "description": "A pull request was created.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -10824,23 +16417,35 @@ "description": "A review was requested on a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -10850,17 +16455,31 @@ "description": "A pull request was marked as in progress.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -10868,19 +16487,32 @@ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -10888,19 +16520,32 @@ "description": "A pull request was merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" @@ -10910,21 +16555,32 @@ "description": "A pull request was marked as ready for review.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" }, @@ -10933,27 +16589,34 @@ "description": "A pull request was rebased.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", - "pull_request_url", - "pull_request_title", - "user", - "user_id", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", + "pull_request_url", + "pull_request_title", + "public_repo", + "created_at", + "operation_type" ] }, { @@ -10961,23 +16624,35 @@ "description": "A review request was removed from a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" }, @@ -10986,18 +16661,32 @@ "description": "A pull request was reopened after previously being closed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -11005,19 +16694,31 @@ "description": "A review comment was added to a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "comment_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -11027,20 +16728,31 @@ "description": "A review comment on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", "@timestamp", "_document_id", - "repo", - "created_at", - "request_id", - "comment_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "comment_id", + "operation_type" ] }, { @@ -11048,18 +16760,31 @@ "description": "A review comment on a pull request was changed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "request_id", - "actor_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "_document_id", - "@timestamp", - "comment_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "comment_id" ] }, { @@ -11067,21 +16792,33 @@ "description": "A review on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ] }, { @@ -11089,20 +16826,33 @@ "description": "A review on a pull request was dismissed.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" }, @@ -11111,19 +16861,33 @@ "description": "A review on a pull request was submitted.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" @@ -11133,23 +16897,33 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", - "actor_id", - "user_id", - "created_at", - "user_agent", - "actor", - "action", - "repo", - "visibility", "_document_id", - "previous_visibility", - "programmatic_access_type" - ], + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility", + "previous_visibility" + ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, { @@ -11157,21 +16931,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -11180,25 +16963,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -11207,23 +16997,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -11232,24 +17030,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -11258,23 +17063,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -11284,22 +17097,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -11308,19 +17130,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -11329,24 +17164,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -11355,24 +17200,32 @@ "description": "Autofix for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "public_repo", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11380,24 +17233,32 @@ "description": "Autofix for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11405,24 +17266,32 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11430,24 +17299,32 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11455,23 +17332,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -11482,17 +17368,29 @@ "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -11502,17 +17400,29 @@ "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -11522,25 +17432,31 @@ "description": "Code scanning using the default setup was disabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -11549,26 +17465,34 @@ "description": "Code scanning using the default setup was enabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "query_suite", "threat_model", - "languages", - "request_access_security_header" + "languages" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -11577,25 +17501,34 @@ "description": "Code scanning using the default setup was updated for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "query_suite", - "threat_model", - "languages", - "repo", - "repo_id", - "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "query_suite", + "threat_model", + "languages", + "public_repo", + "created_at", + "operation_type", "actor_is_bot" ], "docs_reference_titles": "Configuring default setup for code scanning" @@ -11605,20 +17538,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "visibility", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11626,17 +17570,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11645,15 +17602,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -11664,16 +17634,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11683,17 +17666,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11703,19 +17699,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11724,17 +17731,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11743,26 +17763,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -11771,30 +17797,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ - "repo", - "user_id", - "visibility", - "repo_id", - "user", - "request_id", - "actor_id", - "action", - "operation_type", - "request_category", "@timestamp", - "created_at", "_document_id", + "action", "actor", - "user_agent", - "org", - "oauth_application_id", - "org_id", - "request_method", + "actor_id", "business", "business_id", - "public_repo", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "request_category", + "created_at", + "oauth_application_id", + "request_method", + "public_repo", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -11804,20 +17835,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -11826,25 +17868,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -11853,23 +17903,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -11877,25 +17938,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -11905,17 +17975,30 @@ "description": "A repository was archived on disk.", "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories", "fields": [ - "actor_id", - "repo", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", - "repo_id", - "actor", "action", - "user_agent" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/archiving-a-github-repository/archiving-repositories" }, @@ -11924,23 +18007,32 @@ "description": "A source code archive of a repository was downloaded as a ZIP file.", "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "created_at", "operation_type", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" @@ -11950,62 +18042,95 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "visibility", - "repo_id", - "created_at", - "actor", - "action", - "@timestamp", "org_id", - "request_id", + "programmatic_access_type", "repo", - "_document_id" - ] - }, - { - "action": "repo.noindex", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "visibility", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", - "actor_id", - "created_at", + "token_id", + "token_scopes", "user", - "operation_type", - "actor", - "user_agent", - "repo", "user_id", - "public_repo" + "user_agent", + "operation_type", + "visibility", + "created_at" ] }, { - "action": "repo.override_unlock", - "description": "The repository was unlocked.", + "action": "repo.noindex", + "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", "operation_type", + "public_repo" + ] + }, + { + "action": "repo.override_unlock", + "description": "The repository was unlocked.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "created_at", - "_document_id" + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -12013,20 +18138,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "action", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "operation_type", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "visibility", - "actor", - "user_id" + "visibility" ] }, { @@ -12034,23 +18170,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -12058,21 +18204,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -12080,21 +18236,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -12102,22 +18268,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -12125,21 +18300,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -12147,20 +18332,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -12168,22 +18364,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -12191,18 +18396,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -12210,22 +18429,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -12233,21 +18462,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -12255,18 +18494,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -12275,22 +18526,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12299,24 +18559,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12325,23 +18593,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -12349,26 +18627,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -12377,21 +18660,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -12400,25 +18692,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -12426,22 +18724,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -12450,20 +18758,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "visibility", - "operation_type", - "repo", + "@timestamp", "_document_id", - "user", - "user_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "@timestamp", - "request_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -12471,19 +18790,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -12491,17 +18821,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -12510,17 +18855,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -12529,7 +18889,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -12544,46 +18925,66 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "public_repo" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" - }, - { - "action": "repo.set_actions_private_fork_pr_approvals_policy", - "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", + "created_at", + "operation_type", + "public_repo" + ], + "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + }, + { + "action": "repo.set_actions_private_fork_pr_approvals_policy", + "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -12594,21 +18995,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -12617,22 +19029,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -12641,21 +19063,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -12664,22 +19097,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -12690,16 +19133,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -12708,22 +19162,31 @@ "description": "Temporary access was enabled for a repository.", "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing user-owned repositories in your enterprise" }, @@ -12733,22 +19196,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -12757,23 +19231,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -12783,19 +19267,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -12803,21 +19297,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -12826,24 +19330,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -12851,25 +19364,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12878,24 +19398,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12904,25 +19434,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12931,22 +19469,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12955,26 +19502,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -12982,31 +19537,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "created_at", - "oauth_application_id", - "user", - "@timestamp", - "repo", - "operation_type", - "request_id", - "org_id", "actor_id", - "visibility", - "old_permission", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "visibility", + "old_permission", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13015,24 +19577,30 @@ "description": "Branch protections were disabled for the repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -13041,24 +19609,30 @@ "description": "Branch protections were enabled for this repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -13067,25 +19641,31 @@ "description": "Code security was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -13094,25 +19674,31 @@ "description": "Code security was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -13121,21 +19707,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -13143,21 +19739,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -13165,21 +19771,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -13187,20 +19804,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -13208,21 +19837,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -13230,19 +19870,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -13250,31 +19903,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -13283,19 +19944,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -13303,8 +19975,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -13313,23 +19984,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -13354,26 +20034,32 @@ "description": "Automatic partner validation checks have been disabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -13382,26 +20068,32 @@ "description": "Automatic partner validation checks have been enabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -13410,23 +20102,30 @@ "description": "A custom pattern was created for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13436,23 +20135,30 @@ "description": "A custom pattern was removed from secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13462,24 +20168,31 @@ "description": "A custom pattern was published for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13489,24 +20202,31 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -13515,24 +20235,31 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13542,23 +20269,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13568,23 +20302,31 @@ "description": "Secret scanning was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "public_repo", - "programmatic_access_type" + "public_repo" ], "docs_reference_titles": "About secret scanning" }, @@ -13593,22 +20335,30 @@ "description": "Secret scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13616,24 +20366,32 @@ "description": "Secret scanning for non-provider patterns was disabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -13642,24 +20400,32 @@ "description": "Secret scanning for non-provider patterns was enabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -13668,19 +20434,31 @@ "description": "A role or team was added to the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -13689,24 +20467,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -13715,24 +20501,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -13741,19 +20535,31 @@ "description": "A role or team was removed from the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -13762,26 +20568,31 @@ "description": "Secret scanning push protection was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -13790,26 +20601,31 @@ "description": "Secret scanning push protection was enabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -13818,28 +20634,36 @@ "description": "A code security configuration was applied to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13847,27 +20671,35 @@ "description": "A code security configuration failed to attach to the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13875,28 +20707,36 @@ "description": "A code security configuration was removed from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13904,28 +20744,36 @@ "description": "A code security configuration was removed due to a change in repository or enterprise settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "security_configuration_id", - "security_configuration_name", - "repository_security_configuration_state", - "repository_security_configuration_failure_reason", - "repo", - "repo_id", - "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "actor_is_bot", - "request_access_security_header" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "security_configuration_id", + "security_configuration_name", + "repository_security_configuration_state", + "repository_security_configuration_failure_reason", + "public_repo", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -13933,29 +20781,37 @@ "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -13964,29 +20820,37 @@ "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -13995,19 +20859,32 @@ "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ - "operation_type", - "request_id", - "repo_id", "@timestamp", - "user_agent", - "alert_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "alert_id", + "created_at", + "alert_number" ], "docs_reference_titles": "About Dependabot alerts" }, @@ -14016,23 +20893,32 @@ "description": "A Dependabot alert was manually dismissed.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "operation_type", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "alert_id", - "actor", - "repo", "created_at", - "org", - "_document_id", - "action", - "actor_id", "dismiss_reason", - "user", "dismiss_comment", "alert_number", "actor_is_bot" @@ -14043,21 +20929,33 @@ "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "public_repo", "owner", - "_document_id", - "@timestamp", "operation_type", - "token_scopes", "alert_number" ] }, @@ -14066,26 +20964,34 @@ "description": "A Dependabot alert was manually reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type", - "business", - "business_id", "public_repo", - "alert_number", - "request_access_security_header" + "alert_number" ] }, { @@ -14093,21 +20999,32 @@ "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", "docs_reference_links": "N/A", "fields": [ - "alert_id", - "repo", - "operation_type", - "action", - "repo_id", - "_document_id", - "user_agent", - "request_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "alert_id", + "operation_type", + "created_at", + "alert_number" ] }, { @@ -14115,21 +21032,35 @@ "description": "A Dependabot alert was withdrawn.", "docs_reference_links": "N/A", "fields": [ - "alert_id", - "alert_number", - "ghsa_id", - "created_at", - "active", + "@timestamp", + "_document_id", "action", - "repository_id", - "repo", - "repo_id", - "public_repo", - "owner", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "alert_number", + "ghsa_id", + "created_at", + "active", + "public_repo", + "owner", "operation_type" ] }, @@ -14138,20 +21069,30 @@ "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", "fields": [ - "org", + "@timestamp", "_document_id", - "repo", - "org_id", - "operation_type", - "created_at", - "actor", "action", - "@timestamp", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" }, @@ -14160,24 +21101,31 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -14185,26 +21133,32 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14212,23 +21166,30 @@ "description": "Dependabot alerts was disabled.", "docs_reference_links": "N/A", "fields": [ - "repo", - "request_id", - "repo_id", - "action", - "actor_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "_document_id", "user_id", - "operation_type", - "token_scopes", - "programmatic_access_type" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14236,23 +21197,30 @@ "description": "Dependabot alerts was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_agent", - "created_at", "@timestamp", - "repo_id", + "_document_id", "action", - "user", - "repo", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor_id", - "_document_id", - "user_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot" ] }, @@ -14261,18 +21229,31 @@ "description": "Email notification restrictions for an organization or enterprise were disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -14281,19 +21262,31 @@ "description": "Email notification restrictions for an organization or enterprise were enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -14302,14 +21295,28 @@ "description": "GitHub detected a secret and created a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -14323,22 +21330,32 @@ "description": "A secret scanning alert was reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", - "action", - "_document_id", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", + "public_repo", "created_at", "operation_type", - "token_scopes", "secret_type_display_name" ] }, @@ -14347,28 +21364,37 @@ "description": "A secret scanning alert was resolved.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "resolution", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", + "resolution", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type", "secret_type_display_name", "publicly_leaked", - "multi_repo", - "request_access_security_header" + "multi_repo" ] }, { @@ -14376,25 +21402,32 @@ "description": "A secret scanning alert was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -14402,14 +21435,28 @@ "description": "A secret scanning alert was validated.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "previous_validity", @@ -14426,19 +21473,30 @@ "description": "Secret scanning was disabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -14447,19 +21505,30 @@ "description": "Secret scanning was enabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -14468,20 +21537,30 @@ "description": "Secret scanning was disabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -14490,19 +21569,30 @@ "description": "Secret scanning was enabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -14511,14 +21601,28 @@ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "push_protection_bypass_reason", @@ -14536,25 +21640,33 @@ "description": "A request to bypass secret scanning push protection was approved by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -14563,25 +21675,33 @@ "description": "A request to bypass secret scanning push protection was denied by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", - "request_access_security_header", "request_reviewer_comment" ], "docs_reference_titles": "About push protection" @@ -14591,25 +21711,33 @@ "description": "A user requested to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" }, @@ -14618,22 +21746,35 @@ "description": "A secret scanning scan has completed on this repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "repo_id", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "source", "type", "source_slug", "type_slug", "started_at", "completed_at", - "repo", "public_repo", - "org", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "secret_types", @@ -14647,10 +21788,28 @@ "description": "A security configuration was created", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -14665,15 +21824,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -14691,22 +21843,33 @@ "description": "A default security configuration setting for new repositories was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14715,22 +21878,33 @@ "description": "A default security configuration setting for new repositories was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14739,10 +21913,28 @@ "description": "A security configuration was deleted", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -14757,15 +21949,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -14782,15 +21967,30 @@ "description": "A security configuration policy was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enforcement", "security_configuration_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14800,10 +22000,28 @@ "description": "A security configuration was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -14818,15 +22036,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -14844,18 +22055,30 @@ "description": "A security key was registered for an account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "created_at", - "user_id", - "action", - "operation_type", - "request_id", "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -14863,18 +22086,30 @@ "description": "A security key was removed from an account.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "operation_type", - "_document_id", - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14882,16 +22117,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14901,18 +22149,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -14921,16 +22182,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -14941,15 +22215,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -14959,15 +22246,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -14976,17 +22278,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -14995,17 +22310,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -15014,16 +22343,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -15033,14 +22375,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", - "actor", - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -15050,17 +22407,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -15069,17 +22439,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -15088,18 +22471,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15108,15 +22504,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -15126,16 +22536,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -15143,15 +22566,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -15162,16 +22598,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -15181,17 +22630,30 @@ "description": "Triggered when you send an email update to your sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", "fields": [ - "request_id", - "actor", - "action", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" }, @@ -15200,17 +22662,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -15221,17 +22696,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -15242,18 +22730,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15263,16 +22762,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15282,17 +22794,30 @@ "description": "You join the waitlist to join GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "actor_id", - "action", "operation_type", - "created_at", - "user", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -15301,16 +22826,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15322,17 +22860,30 @@ "fields": [ "@timestamp", "_document_id", - "fingerprint", - "operation_type", - "openssh_public_key", - "org_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "request_id" + "fingerprint", + "operation_type", + "openssh_public_key", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15341,19 +22892,32 @@ "description": "An SSH certificate authority for an organization or enterprise was deleted.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "created_at", + "@timestamp", "_document_id", - "fingerprint", - "operation_type", + "action", "actor", - "org_id", - "openssh_public_key", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", - "request_id" + "created_at", + "fingerprint", + "operation_type", + "openssh_public_key" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15362,21 +22926,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "user", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "request_id", - "org", - "org_id", - "created_at", - "actor", "action", - "user_id", + "actor", + "actor_id", "business", "business_id", - "@timestamp", - "actor_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15385,19 +22958,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "actor_id", - "user_id", - "org", - "operation_type", - "request_id", "@timestamp", "_document_id", - "actor", - "user", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15406,20 +22990,34 @@ "description": "The verification code expiry time for an organization or enterprise domain was set.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "token_expires_at", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15427,18 +23025,33 @@ "description": "An organization or enterprise domain was unverified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ] }, { @@ -15446,16 +23059,31 @@ "description": "An organization or enterprise domain was verified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "domain_name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15463,23 +23091,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15487,23 +23125,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15511,23 +23159,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15535,23 +23193,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15559,15 +23227,30 @@ "description": "Triggered when you accept a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -15576,15 +23259,30 @@ "description": "Triggered when you cancel a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -15593,15 +23291,30 @@ "description": "Triggered when you create a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -15610,15 +23323,30 @@ "description": "Triggered when you decline a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -15627,15 +23355,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15643,15 +23386,30 @@ "description": "Triggered when you revoke a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -15660,21 +23418,31 @@ "description": "A member of an organization was added to a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", "fields": [ - "user_agent", - "request_id", - "org_id", - "user_id", - "team", - "user", "@timestamp", - "actor_id", - "created_at", - "operation_type", "_document_id", - "org", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" @@ -15684,22 +23452,31 @@ "description": "A team was given access and permissions to a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "team", - "action", - "operation_type", - "request_id", - "created_at", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "actor_id", - "_document_id", "repo_id", - "user_agent", - "org_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -15708,20 +23485,31 @@ "description": "A child team was created or a child team's parent was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", "fields": [ - "org", "@timestamp", - "created_at", "_document_id", - "team", "action", - "operation_type", "actor", - "request_id", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", + "operation_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" }, @@ -15730,18 +23518,31 @@ "description": "A team's privacy level was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", "fields": [ - "user_agent", - "request_id", - "org", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", "created_at", "operation_type", - "actor_id", - "org_id", - "@timestamp", - "actor", - "_document_id", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" @@ -15751,21 +23552,32 @@ "description": "A new team is created.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "oauth_application_id", + "operation_type", "team", - "org", - "actor", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "team_type" ] }, @@ -15774,21 +23586,31 @@ "description": "A user was demoted from a team maintainer to a team member.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" }, @@ -15797,40 +23619,63 @@ "description": "A team was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "team", - "org_id", - "actor_id", - "actor", - "action", "@timestamp", - "user_agent", - "request_id", - "operation_type", "_document_id", - "programmatic_access_type", - "team_type" - ] - }, + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", + "operation_type", + "team_type" + ] + }, { "action": "team_discussions.clear", "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "business_id", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", "actor_id", - "user", "business", - "action", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15838,19 +23683,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "operation_type", - "request_id", "actor", - "org", - "created_at", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", - "_document_id" + "operation_type", + "created_at" ] }, { @@ -15858,18 +23714,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", "@timestamp", - "action", "_document_id", - "user_agent", - "user_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business", + "user_id", + "user_agent", "operation_type", - "actor", "created_at" ] }, @@ -15878,22 +23745,31 @@ "description": "A user was promoted from a team member to a team maintainer.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" }, @@ -15902,22 +23778,31 @@ "description": "An organization member was removed from a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", "fields": [ - "request_id", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "team", - "user_id", - "actor", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", + "user_id", "user_agent", - "_document_id", - "token_scopes", - "programmatic_access_type", + "operation_type", + "created_at", + "team", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" @@ -15927,21 +23812,31 @@ "description": "A repository was removed from a team's control.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "org_id", - "repo", - "repo_id", - "action", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "created_at", "team", - "org", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -15949,21 +23844,32 @@ "description": "A team's name was changed.", "docs_reference_links": "N/A", "fields": [ - "name", - "user_agent", - "created_at", - "team", - "operation_type", - "actor_id", - "org", + "@timestamp", + "_document_id", "action", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "_document_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "team", + "operation_type", "team_type" ] }, @@ -15972,17 +23878,30 @@ "description": "Team synchronization with a tenant was disabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "request_id", - "org_id", "actor_id", - "operation_type", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -15991,49 +23910,69 @@ "description": "Team synchronization with a tenant was enabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ - "org_id", - "business_id", - "actor", - "created_at", - "user_agent", "@timestamp", - "operation_type", - "business", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_id", - "action", - "_document_id" - ], - "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" - }, + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" + }, { "action": "team.update_repository_permission", "description": "A team's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "team", - "org_id", "@timestamp", - "org", "_document_id", - "old_permission", - "request_id", - "repo", "action", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "old_permission", "operation_type", "created_at", - "user_agent", "permission", "new_repo_permission", "new_repo_base_role", "old_repo_permission", - "old_repo_base_role", - "token_scopes", - "programmatic_access_type" + "old_repo_base_role" ] }, { @@ -16041,17 +23980,30 @@ "description": "A new trusted device was added.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16059,17 +24011,30 @@ "description": "A trusted device was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16077,14 +24042,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "action", - "request_id", - "user_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -16093,15 +24073,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "created_at", - "user_id", - "operation_type", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action" + "created_at", + "operation_type" ] }, { @@ -16109,13 +24104,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "created_at", - "user_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16123,17 +24135,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "operation_type", - "action", - "_document_id" + "created_at", + "operation_type" ] }, { @@ -16141,17 +24166,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user", - "created_at", - "request_id", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -16159,16 +24197,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16176,34 +24228,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_id", - "action", "@timestamp", - "created_at", - "user_agent", - "user", "_document_id", - "request_id" - ] + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] }, { "action": "two_factor_authentication.add_factor", "description": "A secondary authentication factor was added to a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -16212,18 +24291,30 @@ "description": "Two-factor authentication was disabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", "fields": [ - "actor", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor_id", + "user_agent", "created_at", - "operation_type", - "request_id", - "@timestamp", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Disabling two-factor authentication for your personal account" }, @@ -16232,18 +24323,30 @@ "description": "Two-factor authentication was enabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ - "actor", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Configuring two-factor authentication" }, @@ -16252,15 +24355,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user", - "user_id", - "action", "@timestamp", - "request_id", "_document_id", - "user_agent" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16268,16 +24386,29 @@ "description": "Two factor recovery codes were regenerated for a user account.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", + "operation_type", "created_at" ] }, @@ -16286,18 +24417,30 @@ "description": "A secondary authentication factor was removed from a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -16306,15 +24449,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "created_at", - "_document_id", - "action", - "@timestamp" + "operation_type", + "created_at" ] }, { @@ -16323,16 +24481,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "operation_type", "user_agent", - "action", - "request_id", - "actor", - "actor_id" + "created_at", + "operation_type" ] }, { @@ -16340,19 +24511,31 @@ "description": "An email address was added to a user account.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", "operation_type", - "_document_id", - "actor_id", - "actor", "email", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding an email address to your GitHub account" }, @@ -16361,34 +24544,59 @@ "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "created_at", - "user", "@timestamp", "_document_id", - "request_id", - "actor_id", - "operation_type", - "user_agent", "action", - "request_access_security_header" - ] + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] }, { "action": "user.audit_log_export", "description": "Audit log entries were exported.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "action", - "request_id", - "actor", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", "created_at" ] @@ -16398,20 +24606,31 @@ "description": "A user was blocked by another user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_id", - "_document_id", "actor_id", - "@timestamp", - "user_agent", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -16419,18 +24638,30 @@ "description": "A user changed their password.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "actor_id", - "operation_type", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "created_at", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16438,18 +24669,30 @@ "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -16458,17 +24701,30 @@ "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -16477,16 +24733,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "user_agent", - "created_at", - "user", "action", - "operation_type", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16494,16 +24764,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "_document_id", "@timestamp", - "created_at", - "user_agent", - "operation_type", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16511,16 +24795,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "created_at", - "_document_id", - "user_agent", - "user_id", "@timestamp", - "user", + "_document_id", "action", - "request_access_security_header" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16528,62 +24826,97 @@ "description": "A new user account was created.", "docs_reference_links": "N/A", "fields": [ - "email", - "user_id", - "operation_type", "@timestamp", - "request_id", - "user", - "created_at", "_document_id", - "user_agent", - "actor", - "actor_id", "action", - "programmatic_access_type" - ] - }, - { - "action": "user.create_integration_secret", - "description": "A user secret for Codespaces was created.", - "docs_reference_links": "N/A", - "fields": [ "actor", "actor_id", - "user_agent", - "request_id", - "key", - "visibility", - "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "email", "operation_type", - "request_access_security_header" + "created_at" ] }, { - "action": "user.creation_rate_limit_exceeded", - "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", + "action": "user.create_integration_secret", + "description": "A user secret for Codespaces was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "user_agent", + "@timestamp", "_document_id", - "operation_type", - "oauth_application_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "key", + "visibility", + "integration", + "created_at", + "operation_type" + ] + }, + { + "action": "user.creation_rate_limit_exceeded", + "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -16591,18 +24924,30 @@ "description": "A user account was destroyed by an asynchronous job.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "request_id", - "user_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16611,19 +24956,30 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "oauth_application_id", + "_document_id", "action", - "user", - "created_at", - "user_agent", - "request_id", "actor", "actor_id", - "operation_type", - "_document_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", + "operation_type" ] }, { @@ -16631,18 +24987,30 @@ "description": "A user deleted his or her account, triggering user.async_delete.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", - "created_at", - "user_agent", "user_id", - "operation_type", - "actor_id", - "action", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16650,18 +25018,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "user_agent", "user_id", - "actor_id", - "action", - "operation_type", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16669,18 +25049,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "operation_type", - "created_at", - "_document_id", - "@timestamp", - "user", - "actor_id", - "action", - "request_access_security_header" + "created_at" ] }, { @@ -16689,17 +25081,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user", "_document_id", "action", - "operation_type", - "user_agent", - "created_at", - "request_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16707,17 +25111,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16725,17 +25142,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16743,17 +25173,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16761,21 +25204,31 @@ "description": "An enterprise managed user claimed an email address.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16783,21 +25236,31 @@ "description": "N/A", "docs_reference_links": "An enterprise managed user unclaimed an email address.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." }, @@ -16806,17 +25269,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16824,17 +25300,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16842,17 +25331,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16860,18 +25362,30 @@ "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "action", - "operation_type", - "request_id", - "created_at", - "_document_id", "@timestamp", - "user", - "org_id", + "_document_id", + "action", "actor", "actor_id", - "user_agent" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16879,16 +25393,29 @@ "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", "user_agent", + "operation_type", "created_at" ] }, @@ -16897,17 +25424,31 @@ "description": "A user requested a password reset.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", "fields": [ - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "email", - "created_at", - "user_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" }, @@ -16916,17 +25457,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "created_at", - "user_agent", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor", - "operation_type", - "request_id" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16934,18 +25488,30 @@ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -16954,19 +25520,31 @@ "description": "A user signed in.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "actor_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", + "user_agent", "operation_type", - "_document_id", - "request_id", "created_at", - "actor", - "passkey_nickname", - "request_access_security_header" + "passkey_nickname" ] }, { @@ -16974,18 +25552,30 @@ "description": "A user signed out.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -16993,19 +25583,30 @@ "description": "A comment made by a user was minimized.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", - "actor_id", "@timestamp", - "created_at", - "operation_type", "_document_id", - "user", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17013,18 +25614,30 @@ "description": "A user signed in from a new device.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17032,14 +25645,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", "_document_id", "action", - "@timestamp", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17047,21 +25676,31 @@ "description": "An ordinary user account was promoted to a site administrator.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", + "user_id", "user_agent", + "created_at", "oauth_application_id", - "request_id", - "operation_type", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17069,16 +25708,29 @@ "description": "A user's account was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user", - "action", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "actor", "operation_type" ] }, @@ -17087,20 +25739,31 @@ "description": "An email address was removed from a user account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "actor", - "actor_id", "created_at", - "email", - "token_scopes", - "programmatic_access_type" + "email" ] }, { @@ -17108,20 +25771,32 @@ "description": "A user secret for Codespaces was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "key", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "key", + "integration", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17129,17 +25804,30 @@ "description": "A user account was no longer flagged as a large scale contributor.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -17147,20 +25835,31 @@ "description": "A username was changed.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "request_id", - "actor_id", - "old_login", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "operation_type", "user_agent", - "token_scopes", - "programmatic_access_type" + "old_login", + "created_at", + "operation_type" ] }, { @@ -17168,17 +25867,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "user_agent", - "request_id", - "action", "@timestamp", - "created_at", - "org_id", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -17187,18 +25898,30 @@ "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "action", "created_at", - "actor", - "operation_type", - "actor_id", - "user_id", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam" }, @@ -17207,18 +25930,30 @@ "description": "A user reset their account password.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "@timestamp", - "_document_id", - "actor", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17226,16 +25961,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_id", - "action", "@timestamp", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -17246,16 +25994,28 @@ "fields": [ "@timestamp", "_document_id", - "request_id", - "user_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor_id", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -17264,18 +26024,30 @@ "description": "A user signed in from an unrecognized device.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "created_at", - "actor", - "actor_id", - "@timestamp", - "request_access_security_header" + "created_at" ] }, { @@ -17283,18 +26055,30 @@ "description": "A user signed in from an unrecognized device and location.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "created_at", - "_document_id", - "request_id", - "action", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17302,18 +26086,30 @@ "description": "A user signed in from an unrecognized location.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "action", - "operation_type", - "user_agent", - "user", + "@timestamp", "_document_id", + "action", "actor", - "created_at", "actor_id", - "@timestamp", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17321,46 +26117,67 @@ "description": "Triggered when you clear the status on your profile.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "message", - "user", - "actor_id", "created_at", + "limited_availability", + "emoji", + "operation_type" + ] + }, + { + "action": "user_status.update", + "description": "Triggered when you set or change the status on your profile.", + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "limited_availability", - "action", - "emoji", - "operation_type", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "@timestamp", - "_document_id", - "request_access_security_header" - ] - }, - { - "action": "user_status.update", - "description": "Triggered when you set or change the status on your profile.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", - "fields": [ "limited_availability", - "user", - "action", - "actor_id", "message", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", - "user_agent", "emoji", - "org", - "actor", - "operation_type", - "token_scopes", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Personalize your profile" }, @@ -17369,21 +26186,31 @@ "description": "A user account was suspended.", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", - "operation_type", - "actor_id", - "user", - "user_agent", - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", - "user_id", + "_document_id", "action", - "token_scopes", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -17391,18 +26218,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", - "actor_id", "@timestamp", - "operation_type", "_document_id", - "user_agent", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17410,18 +26249,30 @@ "description": "A 2FA challenge issued for a user account failed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "_document_id", - "user_agent", - "user", - "actor_id", - "actor", - "user_id", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17431,16 +26282,28 @@ "fields": [ "@timestamp", "_document_id", - "user_id", - "operation_type", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "actor", + "user_id", "user_agent", - "request_id", - "action", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -17448,18 +26311,30 @@ "description": "A user used their 2FA recovery codes.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "user_agent", - "request_id", - "user", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "created_at", - "@timestamp", - "_document_id", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17467,18 +26342,30 @@ "description": "A user downloaded 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -17486,17 +26373,30 @@ "description": "A user printed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", - "user_agent", - "request_id", - "user_id", - "created_at", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17504,18 +26404,30 @@ "description": "A user viewed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_agent", - "actor", - "user_id", - "action", - "created_at", - "user", - "operation_type", "@timestamp", - "request_id", "_document_id", - "request_access_security_header" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17523,17 +26435,30 @@ "description": "A user was prompted for a two-factor authentication code.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", "fields": [ - "user", - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "actor" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" }, @@ -17542,19 +26467,31 @@ "description": "A user was unblocked by another user.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "actor", - "@timestamp", - "user_agent", - "user_id", - "user", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -17563,15 +26500,28 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user_agent", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "request_id", - "actor", - "action", "created_at" ] }, @@ -17580,21 +26530,31 @@ "description": "A user account was unsuspended.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", - "user", "action", - "user_agent", "actor", - "oauth_application_id", - "operation_type", "actor_id", - "created_at", - "@timestamp", - "user_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -17602,21 +26562,33 @@ "description": "A user secret for Codespaces was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17624,18 +26596,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17643,16 +26627,30 @@ "description": "A Dependabot rule was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17662,16 +26660,30 @@ "description": "A Dependabot rule was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17681,18 +26693,31 @@ "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17702,21 +26727,33 @@ "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17724,21 +26761,32 @@ "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -17746,21 +26794,32 @@ "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -17768,16 +26827,30 @@ "description": "A Dependabot rule's conditions, actions, or metadata changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17787,27 +26860,33 @@ "description": "A workflow job was approved.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", - "repo", - "repo_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -17816,23 +26895,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17840,10 +26929,28 @@ "description": "A workflow run was cancelled.", "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17854,20 +26961,9 @@ "run_number", "cancelled_at", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Canceling a workflow run" }, @@ -17876,23 +26972,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17902,10 +27006,28 @@ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17917,19 +27039,9 @@ "conclusion", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -17940,10 +27052,28 @@ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17952,21 +27082,10 @@ "head_branch", "head_sha", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "public_repo", - "programmatic_access_type", "actor_is_bot", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "Understanding GitHub Actions" @@ -17976,23 +27095,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -18001,22 +27132,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -18024,21 +27166,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -18046,25 +27199,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -18072,23 +27233,36 @@ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", "fields": [ - "repo_id", - "repo", - "org_id", - "org", - "business_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "job_name", "runner_labels", "is_hosted_runner", "environment_name", "secrets_passed", - "action", - "_document_id", "operation_type", "created_at", - "@timestamp", "runner_owner_type", "job_workflow_ref", "calling_workflow_refs", @@ -18102,24 +27276,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -18128,10 +27311,28 @@ "description": "A workflow run was re-run.", "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -18141,21 +27342,11 @@ "head_sha", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", "rerun_type", "check_run_id", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "Re-running workflows and jobs" @@ -18165,25 +27356,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.18/organization.json b/src/audit-logs/data/ghes-3.18/organization.json index 3de92e4d061c..3d8cd114ddae 100644 --- a/src/audit-logs/data/ghes-3.18/organization.json +++ b/src/audit-logs/data/ghes-3.18/organization.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,29 +67,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -72,21 +103,32 @@ "description": "Credit was accepted for a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Editing a repository security advisory" }, @@ -95,21 +137,32 @@ "description": "Someone was added to the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -117,21 +170,32 @@ "description": "Credit was declined for a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -140,21 +204,32 @@ "description": "Someone was removed from the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -163,18 +238,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -182,17 +269,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -203,39 +301,62 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" - }, + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -244,19 +365,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -265,18 +398,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -284,18 +430,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -303,20 +461,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -325,20 +494,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -349,17 +529,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -367,15 +559,31 @@ "description": "Existing code scanning alerts appeared in a branch.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -385,15 +593,31 @@ "description": "Code scanning alerts were fixed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -403,15 +627,31 @@ "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_numbers", - "commit_oid", - "ref", - "request_id", - "org_id", - "org", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", - "business" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_numbers", + "commit_oid", + "ref" ], "docs_reference_titles": "About code scanning" }, @@ -420,15 +660,29 @@ "description": "Code scanning alerts were manually dismissed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers", "dismissal_approver_id" ], @@ -439,19 +693,31 @@ "description": "Dismissal of code scanning alerts was approved.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -462,19 +728,31 @@ "description": "Dismissal of code scanning alerts was denied.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -485,19 +763,31 @@ "description": "Dismissal of code scanning alerts was requested.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -508,13 +798,31 @@ "description": "Code scanning alerts were seen for the first time.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -524,15 +832,31 @@ "description": "Code scanning alerts that were previously fixed reappeared.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -542,15 +866,29 @@ "description": "Code scanning alerts that were previously dismissed were reopened.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -560,14 +898,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -577,28 +930,34 @@ "description": "An attempt to create a codespace from a prebuild was made.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "owner", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "user_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_id", + "user_agent", + "name", + "owner", + "pull_request_id", "created_at", "operation_type", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -606,17 +965,30 @@ "description": "Enterprise setting for Codespaces ownership was updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enablement", "organization_names", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -627,25 +999,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -656,22 +1037,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -683,22 +1075,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -707,15 +1110,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -726,15 +1144,28 @@ "description": "Policies were applied to codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -744,20 +1175,30 @@ "description": "Policies were removed from codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -765,19 +1206,30 @@ "description": "Policies were updated for codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -785,17 +1237,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -805,27 +1270,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "org", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "owner", "pull_request_id", "machine_type", - "user_id", - "user", "devcontainer_path", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -833,19 +1307,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -853,18 +1340,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -873,20 +1372,30 @@ "description": "A commit comment was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "repo", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "created_at", - "@timestamp", - "operation_type", + "programmatic_access_type", + "repo", "repo_id", - "actor_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "programmatic_access_type" + "created_at", + "operation_type" ] }, { @@ -894,21 +1403,30 @@ "description": "A commit comment was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "repo_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_id", - "action", - "@timestamp", - "repo", "org_id", - "actor_id", - "created_at", - "user_agent", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -916,21 +1434,33 @@ "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "reason", "plan", - "org_id", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -938,13 +1468,28 @@ "description": "Copilot feature settings were changed at the organization level.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -954,23 +1499,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -978,16 +1530,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -996,40 +1562,59 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "request_access_security_header" - ] - }, - { - "action": "copilot.cfb_seat_assignment_reused", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "copilot.cfb_seat_assignment_reused", "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1039,20 +1624,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -1060,19 +1655,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -1080,21 +1687,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1102,21 +1718,33 @@ "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_value", "new_value", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1124,21 +1752,32 @@ "description": "The excluded paths for GitHub Copilot were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "excluded_paths", "owner_type", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1146,14 +1785,28 @@ "description": "Copilot custom instructions were created for the organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "action", - "_document_id", - "@timestamp", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "custom_instructions" @@ -1164,14 +1817,28 @@ "description": "Copilot custom instructions were updated for the organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "action", - "_document_id", - "@timestamp", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "custom_instructions" @@ -1182,21 +1849,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1204,21 +1881,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1226,21 +1913,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1248,17 +1945,30 @@ "description": "The plan for GitHub Copilot was updated.", "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_plan", "plan", - "business_id", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1270,20 +1980,31 @@ "description": "The plan for GitHub Copilot was scheduled to be downgraded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "current_plan", "scheduled_plan" @@ -1294,22 +2015,33 @@ "description": "Specific repositories were disabled from using Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "owner_type", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1317,21 +2049,31 @@ "description": "Specific repositories were enabled to use Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "owner_type", - "owner", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1341,20 +2083,32 @@ "description": "Copilot coding agent access was updated for the organization's or user's repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_access", "old_access", - "org_id", "owner_type", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1364,21 +2118,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1388,19 +2151,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1410,21 +2182,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1434,18 +2215,31 @@ "description": "A new custom property definition was created.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -1458,18 +2252,31 @@ "description": "A custom property definition was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -1483,14 +2290,29 @@ "description": "A custom property definition was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "value_type", @@ -1503,8 +2325,7 @@ "old_default_value", "old_value_type", "old_values_editable_by", - "values_editable_by", - "request_access_security_header" + "values_editable_by" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1513,27 +2334,35 @@ "description": "A repository's custom property value was manually set for the first time.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1542,19 +2371,31 @@ "description": "A repository's custom property value was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1563,16 +2404,29 @@ "description": "A repository's custom property value was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "definition_id" @@ -1584,19 +2438,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1605,19 +2470,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1626,40 +2502,62 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" - }, - { - "action": "dependabot_alerts_new_repos.enable", - "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", - "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "user", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + }, + { + "action": "dependabot_alerts_new_repos.enable", + "description": "Dependabot alerts were enabled for all new repositories.", + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1668,21 +2566,31 @@ "description": "The default repository access for Dependabot was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "access_level", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -1691,17 +2599,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1709,19 +2630,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1730,19 +2662,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1750,19 +2693,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1771,19 +2725,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1791,19 +2756,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1812,39 +2788,61 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" - ] - }, - { - "action": "dependency_graph_new_repos.disable", - "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", - "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "dependency_graph_new_repos.disable", + "description": "The dependency graph was disabled for all new repositories.", + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1853,20 +2851,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1874,21 +2882,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", - "repo_id", - "request_id", + "@timestamp", + "_document_id", "action", "actor", - "org_id", - "_document_id", "actor_id", - "operation_type", - "@timestamp", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -1896,20 +2913,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo_id", "@timestamp", - "actor", - "user_agent", - "request_id", - "org", "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "repo", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -1917,22 +2944,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "user_agent", - "actor_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "title", - "_document_id", - "created_at", - "repo", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -1940,21 +2976,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "team", - "created_at", - "user_id", "@timestamp", - "number", - "org", - "title", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", "user_agent", - "operation_type", - "_document_id" + "team", + "created_at", + "number", + "title", + "operation_type" ] }, { @@ -1962,18 +3010,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user_id", - "actor", "number", - "user", - "created_at", - "request_id", - "_document_id" + "created_at" ] }, { @@ -1981,18 +3042,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "action", - "_document_id", - "request_id", - "org", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org_id", "user_agent", - "actor", + "operation_type", "number", "team", "created_at" @@ -2003,21 +3075,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", "_document_id", - "title", - "user", - "user_agent", - "org", - "operation_type", - "actor_id", - "@timestamp", - "actor", - "team", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", + "title", + "operation_type", + "team", "number" ] }, @@ -2026,17 +3109,31 @@ "description": "A global announcement banner was created for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2047,16 +3144,30 @@ "description": "A global announcement banner was removed from the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2067,18 +3178,32 @@ "description": "A global announcement banner was updated for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", "old_message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2089,17 +3214,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was created.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", - "operation_type", "@timestamp", "_document_id", - "org_id", "action", - "request_id", - "org", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -2108,17 +3246,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was deleted.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", + "@timestamp", "_document_id", "action", - "@timestamp", - "actor_id", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -2127,22 +3278,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2151,22 +3311,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2174,28 +3344,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2204,27 +3380,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", - "visibility", - "environment_name", - "repo", - "repo_id", - "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "actor_is_bot", - "request_access_security_header" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "visibility", + "environment_name", + "public_repo", + "created_at", + "operation_type", + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -2233,25 +3417,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2260,26 +3452,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2288,21 +3487,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -2311,22 +3522,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2335,25 +3556,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2362,22 +3592,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -2386,21 +3628,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -2411,19 +3663,30 @@ "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2432,20 +3695,30 @@ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2454,19 +3727,30 @@ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2475,23 +3759,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2499,18 +3792,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -2521,20 +3824,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2544,25 +3857,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -2570,25 +3893,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -2596,26 +3928,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -2624,25 +3965,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -2650,26 +4000,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -2677,21 +4036,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -2700,19 +4070,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -2720,21 +4103,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -2743,19 +4137,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -2766,20 +4174,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2789,24 +4209,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2817,23 +4248,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2844,21 +4287,33 @@ "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", "operation_type", - "@timestamp", "integration", - "action", - "user_agent", "reason", - "_document_id", - "org", - "org_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -2869,20 +4324,32 @@ "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ "@timestamp", - "actor_id", - "org", "_document_id", - "requester", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "requester", "created_at", "url", - "org_id", - "request_id", "operation_type", - "actor", "integration", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -2892,20 +4359,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2915,19 +4395,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -2936,20 +4430,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -2959,20 +4466,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -2981,20 +4501,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -3003,20 +4536,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -3024,19 +4569,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -3045,19 +4603,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -3066,17 +4637,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -3089,21 +4673,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -3117,17 +4714,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -3139,19 +4749,30 @@ "description": "An IP allow list was disabled.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "actor", - "request_id", - "org", - "user_agent", + "@timestamp", "_document_id", - "user_id", + "action", + "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "@timestamp", - "user" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3159,19 +4780,30 @@ "description": "An IP allow list was disabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3179,20 +4811,29 @@ "description": "An IP allow list was enabled.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "user_id", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "business_id", - "_document_id", - "action", - "@timestamp", + "user_id", "user_agent", - "actor_id", "operation_type", - "org", "created_at" ] }, @@ -3201,19 +4842,30 @@ "description": "An IP allow list was enabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3221,24 +4873,32 @@ "description": "An IP address was added to an IP allow list.", "docs_reference_links": "N/A", "fields": [ - "active", - "org", - "ip_allow_list_entry", "@timestamp", "_document_id", - "operation_type", - "created_at", - "user_agent", "action", - "request_id", + "actor", "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "business", - "actor", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", + "ip_allow_list_entry", + "operation_type", + "created_at" ] }, { @@ -3246,24 +4906,32 @@ "description": "An IP address was deleted from an IP allow list.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "ip_allow_list_entry", - "org", - "operation_type", - "created_at", - "active", "action", - "@timestamp", + "actor", + "actor_id", "business", "business_id", - "user_agent", + "hashed_token", + "org", "org_id", - "actor", - "actor_id", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ip_allow_list_entry", + "operation_type", + "created_at", + "active" ] }, { @@ -3271,19 +4939,32 @@ "description": "An IP address or its description was changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", - "actor", - "org", "action", - "operation_type", - "created_at", - "user_agent", + "actor", "actor_id", - "ip_allow_list_entry", - "active", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "ip_allow_list_entry", + "active" ] }, { @@ -3291,22 +4972,31 @@ "description": "A comment on an issue was deleted from the repository.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "org", - "repo", - "actor_id", "@timestamp", - "created_at", "_document_id", "action", - "operation_type", - "user_agent", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "oauth_application_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -3314,24 +5004,30 @@ "description": "A comment on an issue was pinned to a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3342,19 +5038,29 @@ "description": "A comment on an issue was unpinned from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3365,22 +5071,31 @@ "description": "A comment on an issue (other than the initial one) changed.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", - "action", - "repo_id", - "org_id", - "created_at", - "operation_type", "@timestamp", - "user_agent", - "request_id", "_document_id", - "actor_id", + "action", "actor", - "oauth_application_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -3388,21 +5103,31 @@ "description": "An issue was deleted from the repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", "fields": [ - "user", - "actor_id", - "created_at", - "title", "@timestamp", "_document_id", - "request_id", - "actor", - "user_id", "action", - "operation_type", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "title", + "operation_type" ], "docs_reference_titles": "Deleting an issue" }, @@ -3411,23 +5136,33 @@ "description": "An issue was pinned to a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ + "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", "action", "actor", - "operation_type", - "owner_type", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "number", - "repo", - "event", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type", + "owner_type", + "number", + "event" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -3436,22 +5171,32 @@ "description": "An issue was transferred to another repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "owner_type", - "actor_id", "number", - "repo", "operation_type", - "_document_id", - "repo_id", - "action", - "request_id", - "created_at", - "actor", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Transferring an issue to another repository" }, @@ -3460,20 +5205,32 @@ "description": "An issue type was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issue_type_name", "description", "color", "enabled", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3484,20 +5241,32 @@ "description": "An issue type was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issue_type_name", "description", "color", "enabled", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3508,11 +5277,28 @@ "description": "An issue type was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issue_type_name", "description", "color", @@ -3521,11 +5307,6 @@ "old_description", "old_color", "old_enabled", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3536,24 +5317,33 @@ "description": "An issue was unpinned from a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ - "event", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", - "action", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "operation_type", - "_document_id", - "number", - "owner_type", - "@timestamp", + "token_id", + "token_scopes", "user", "user_id", - "token_scopes", - "request_access_security_header" + "user_agent", + "event", + "created_at", + "operation_type", + "number", + "owner_type" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -3562,19 +5352,30 @@ "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user_agent", - "action", "@timestamp", - "operation_type", - "request_id", - "actor_id", - "user_id", - "created_at", "_document_id", + "action", "actor", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "org_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3583,18 +5384,29 @@ "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -3604,19 +5416,30 @@ "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user", - "request_id", - "actor", - "business_id", - "action", - "operation_type", - "user_agent", - "created_at", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor_id" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3625,18 +5448,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3644,21 +5479,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -3666,21 +5514,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -3688,22 +5549,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", - "user", - "created_at", - "user_agent", - "oauth_application", "action", - "request_id", - "marketplace_listing", - "user_id", - "secondary_category", - "oauth_application_id", "actor", "actor_id", - "operation_type", - "@timestamp" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "created_at", + "oauth_application", + "marketplace_listing", + "secondary_category", + "oauth_application_id", + "operation_type" ] }, { @@ -3711,19 +5585,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -3733,22 +5620,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -3756,22 +5656,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -3779,20 +5692,30 @@ "description": "The ability for members to publish GitHub Pages sites was disabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3801,20 +5724,30 @@ "description": "The ability for members to publish GitHub Pages sites was enabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3823,21 +5756,30 @@ "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3846,22 +5788,30 @@ "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3870,21 +5820,30 @@ "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3893,22 +5852,30 @@ "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3917,19 +5884,30 @@ "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "operation_type", "user_agent", - "actor", - "actor_id", - "business_id", - "@timestamp", - "created_at", - "action" + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3938,18 +5916,29 @@ "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "request_id", - "org", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "actor", "operation_type", - "org_id", - "action", - "@timestamp", "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -3959,21 +5948,30 @@ "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "action", - "org_id", - "user_id", - "business", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business_id", + "user_id", + "user_agent", "created_at", - "actor", - "org", - "operation_type", - "user_agent" + "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3984,16 +5982,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -4002,21 +6011,30 @@ "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "created_at", - "user_id", "business_id", - "user", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "org_id", - "@timestamp" + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -4025,19 +6043,30 @@ "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ - "request_id", - "created_at", - "_document_id", - "user_agent", - "user", - "user_id", - "business", - "business_id", - "operation_type", "@timestamp", + "_document_id", "action", "actor", - "actor_id" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -4046,19 +6075,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4066,21 +6107,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4090,16 +6140,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4109,18 +6172,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4130,14 +6206,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -4145,19 +6237,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -4165,18 +6268,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -4184,23 +6299,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -4208,16 +6331,30 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "org_id", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4225,24 +6362,32 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", - "repo_id", "operation_type", - "@timestamp", - "user_agent", "created_at", - "org", - "action", - "_document_id", - "repo", - "actor", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4250,15 +6395,28 @@ "description": "A network configuration for a hosted compute service was created.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -4276,15 +6434,28 @@ "description": "A network configuration for a hosted compute service was deleted.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -4297,45 +6468,70 @@ "description": "A network configuration for a hosted compute service was updated.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "actor_is_bot", - "selected_service", - "network_settings_ids", - "previous_settings_ids", - "failover_network_settings_ids", - "failover_network_enabled" - ], - "docs_reference_titles": "About networking for hosted compute products in your enterprise" - }, + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot", + "selected_service", + "network_settings_ids", + "previous_settings_ids", + "failover_network_settings_ids", + "failover_network_enabled" + ], + "docs_reference_titles": "About networking for hosted compute products in your enterprise" + }, { "action": "oauth_application.create", "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4344,20 +6540,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4366,20 +6574,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4388,20 +6608,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4410,19 +6642,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4431,20 +6676,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4453,20 +6710,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4475,19 +6744,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4496,17 +6778,28 @@ "description": "An invitation sent to an organization to join an enterprise was accepted.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4517,20 +6810,30 @@ "description": "A billing manager was added to an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "org", - "user_id", "action", - "created_at", - "org_id", - "user", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" }, @@ -4539,19 +6842,29 @@ "description": "An organization prevented access to resources by users with the given two-factor method.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "two_factor_method", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "two_factor_method", "created_at", "operation_type", "actor_is_bot" @@ -4562,21 +6875,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -4585,24 +6908,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4610,21 +6943,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -4632,20 +6975,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -4653,22 +7006,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -4676,20 +7037,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -4697,44 +7068,62 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" - ] + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] }, { "action": "org.advanced_security_entity_policy_update", "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "new_policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "new_policy", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -4744,19 +7133,30 @@ "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -4765,19 +7165,30 @@ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -4787,15 +7198,28 @@ "description": "Third-party application access for outside collaborators was disabled for the organization.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4806,15 +7230,28 @@ "description": "Third-party application access for outside collaborators was enabled for the organization.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4825,15 +7262,28 @@ "description": "The organization was archived.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4843,17 +7293,30 @@ "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", "fields": [ - "org_id", - "operation_type", "@timestamp", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" }, @@ -4862,21 +7325,32 @@ "description": "An export of the organization's Git events was created.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "start", "end", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" }, @@ -4885,16 +7359,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_agent", - "action", "@timestamp", - "actor_id", - "org_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -4903,18 +7390,31 @@ "description": "An organization owner blocked a user from accessing the organization's repositories.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", "fields": [ - "actor", - "user_agent", - "org_id", - "created_at", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "blocked_user", + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" }, @@ -4923,19 +7423,30 @@ "description": "An invitation for an organization to join an enterprise was revoked", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "initiated_from" ], "docs_reference_titles": "Adding organizations to your enterprise" @@ -4945,22 +7456,33 @@ "description": "An invitation sent to a user to join an organization was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "email", - "@timestamp", - "actor", - "action", "operation_type", - "user_agent", - "org", "invitation_id", - "_document_id", "created_at", - "invitee_email", - "token_scopes", - "programmatic_access_type" + "invitee_email" ] }, { @@ -4968,19 +7490,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -4988,16 +7521,28 @@ "description": "Cleared two-factor authentication restrictions for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -5008,23 +7553,31 @@ "description": "Autofix for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5032,21 +7585,31 @@ "description": "Autofix for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5054,23 +7617,31 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5078,23 +7649,31 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5102,21 +7681,30 @@ "description": "Code scanning using the default setup was disabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -5125,21 +7713,30 @@ "description": "Code scanning using the default setup was enabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -5148,20 +7745,31 @@ "description": "Access to use Codespaces on internal and private repositories was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "enablement", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "enablement", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization" }, @@ -5170,21 +7778,31 @@ "description": "Ownership and payment for codespaces was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "owner_type", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" }, @@ -5193,16 +7811,29 @@ "description": "A team has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5212,16 +7843,29 @@ "description": "A team has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5231,19 +7875,30 @@ "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -5252,17 +7907,30 @@ "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -5271,21 +7939,30 @@ "description": "A user has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -5293,21 +7970,30 @@ "description": "A user has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -5315,16 +8001,29 @@ "description": "The interaction limit for collaborators only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "request_id", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" @@ -5334,17 +8033,30 @@ "description": "The interaction limit for prior contributors only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "operation_type", "@timestamp", - "created_at", - "user_agent", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", - "actor", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5353,17 +8065,30 @@ "description": "The interaction limit for existing users only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", "_document_id", - "operation_type", - "actor_id", - "org_id", "action", - "created_at", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5373,16 +8098,29 @@ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ "@timestamp", - "created_at", "_document_id", - "actor_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "action", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5391,17 +8129,30 @@ "description": "The interaction limit for prior contributors only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "operation_type", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5410,17 +8161,30 @@ "description": "The interaction limit for existing users only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "actor_id", - "request_id", + "@timestamp", + "_document_id", "action", - "created_at", - "user_agent", "actor", - "_document_id", - "org_id", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5429,22 +8193,30 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" }, @@ -5453,17 +8225,28 @@ "description": "An invitation for an organization to join an enterprise was confirmed.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5474,15 +8257,28 @@ "description": "Server statistics were exported for the organization.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5493,18 +8289,30 @@ "description": "An organization was created.", "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", "fields": [ - "request_id", - "org", - "actor_id", - "actor", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "org_id", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" }, @@ -5513,20 +8321,31 @@ "description": "A GitHub Actions secret was created for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5535,20 +8354,32 @@ "description": "A GitHub Actions variable was created for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", - "visibility", - "org", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "visibility", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5557,21 +8388,33 @@ "description": "A Codespaces or Dependabot secret was created for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -5579,21 +8422,30 @@ "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor_id", - "org_id", - "business", - "action", "@timestamp", - "org", "_document_id", - "business_id", + "action", "actor", - "token_scopes", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "actor_is_bot", "oauth_credential_type", "managed_oauth_access_id", @@ -5609,24 +8461,32 @@ "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", "fields": [ - "user_agent", - "actor", "@timestamp", - "created_at", - "org_id", - "business_id", - "operation_type", - "request_id", "_document_id", "action", + "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", - "token_scopes", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot", "oauth_credential_type", - "request_access_security_header", "managed_oauth_access_id", "managed_token_id", "managed_oauth_scopes", @@ -5640,21 +8500,32 @@ "description": "An owner revoked authorized credentials.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "oauth_application_id", - "org_id", "operation_type", - "action", - "business", - "request_id", "created_at", - "business_id", - "actor_id", - "_document_id", - "user_agent", "oauth_credential_type", "managed_oauth_access_id", "managed_token_id", @@ -5669,18 +8540,30 @@ "description": "An organization was deleted by a user or staff.", "docs_reference_links": "N/A", "fields": [ - "user_agent", "@timestamp", "_document_id", - "created_at", - "actor", - "org_id", - "org", "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5688,20 +8571,30 @@ "description": "Team creation was limited to owners.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "actor", "@timestamp", "_document_id", - "user", - "user_id", "action", - "created_at", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -5710,16 +8603,29 @@ "description": "Third-party application access restrictions for an organization were disabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "org_id", - "action", - "_document_id", - "request_id", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" @@ -5729,19 +8635,30 @@ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -5750,37 +8667,63 @@ "description": "SAML single sign-on was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "sso_url", - "issuer", - "action", "@timestamp", "_document_id", - "created_at", - "org", - "operation_type" - ] - }, - { - "action": "org.disable_source_ip_disclosure", - "description": "Display of IP addresses within audit log events for the organization was disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", - "fields": [ + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "issuer", "created_at", - "operation_type", + "operation_type" + ] + }, + { + "action": "org.disable_source_ip_disclosure", + "description": "Display of IP addresses within audit log events for the organization was disabled.", + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "business_id" + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" }, @@ -5789,17 +8732,30 @@ "description": "A two-factor authentication requirement was disabled for the organization.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "org_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "_document_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5807,19 +8763,30 @@ "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "user", - "action", - "operation_type", "@timestamp", "_document_id", - "created_at", - "user_agent", - "org", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5827,19 +8794,30 @@ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "user", - "action", - "actor_id", - "org_id" + "created_at" ] }, { @@ -5847,19 +8825,30 @@ "description": "Team creation by members was allowed.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "org_id", - "user", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -5868,17 +8857,30 @@ "description": "Third-party application access restrictions for an organization were enabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "operation_type", - "org", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" }, @@ -5887,19 +8889,30 @@ "description": "An organization owner allowed users with read access to create discussions in an organization", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -5908,19 +8921,32 @@ "description": "SAML single sign-on was enabled for the organization.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", - "sso_url", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "@timestamp", - "issuer", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "sso_url", + "created_at", + "issuer" ], "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" }, @@ -5929,21 +8955,30 @@ "description": "Display of IP addresses within audit log events for the organization was enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" }, @@ -5952,17 +8987,30 @@ "description": "Two-factor authentication is now required for the organization.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "actor_id", - "action", - "_document_id", - "org", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" }, @@ -5971,17 +9019,30 @@ "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "org_id", - "manager", "@timestamp", - "request_id", - "actor", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "manager", + "operation_type", "created_at" ] }, @@ -5990,18 +9051,31 @@ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", "docs_reference_links": "N/A", "fields": [ - "org_id", "@timestamp", - "org", - "user_agent", - "request_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "manager", "operation_type", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6009,23 +9083,32 @@ "description": "A new user was invited to join an organization.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", "fields": [ - "org", - "user_id", - "invitation_id", - "org_id", - "user", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", - "created_at", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "invitee_email", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitation_id", + "operation_type", + "created_at", + "invitee_email" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" }, @@ -6034,17 +9117,28 @@ "description": "An organization was invited to join an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -6054,19 +9148,30 @@ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6074,19 +9179,30 @@ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "org", - "org_id", - "user_agent", - "actor_id", - "user_id", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6094,19 +9210,31 @@ "description": "Access to an organization was granted for an OAuth App.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "request_id", "actor_id", - "operation_type", - "org_id", - "_document_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" @@ -6116,20 +9244,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -6138,40 +9277,65 @@ "description": "Access was disabled for an OAuth App that was previously approved.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", "fields": [ - "request_id", - "url", - "created_at", - "org_id", - "action", "@timestamp", "_document_id", - "user_agent", - "org", - "operation_type", + "action", "actor", "actor_id", - "oauth_application_name" - ], - "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", + "operation_type", + "oauth_application_name" + ], + "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" }, { "action": "org.oauth_app_access_requested", "description": "An organization member requested that an owner grant an OAuth App access to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", + "@timestamp", "_document_id", - "request_id", - "url", - "org_id", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "url", "oauth_application_name" ] }, @@ -6180,20 +9344,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -6203,16 +9378,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "org_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type", - "_document_id", - "org" + "created_at", + "operation_type" ] }, { @@ -6220,20 +9408,31 @@ "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "reason", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "reason", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -6242,20 +9441,30 @@ "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -6264,19 +9473,30 @@ "description": "An organization owner downloaded the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6285,19 +9505,30 @@ "description": "An organization owner generated the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6306,19 +9537,30 @@ "description": "An organization owner printed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6327,40 +9569,63 @@ "description": "An organization owner viewed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "business", - "business_id" - ], - "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" - }, - { - "action": "org.register_self_hosted_runner", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" + }, + { + "action": "org.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", "fields": [ - "actor", - "operation_type", "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "actor_is_bot", - "request_access_security_header" + "operation_type", + "created_at", + "actor_is_bot" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -6369,20 +9634,31 @@ "description": "A GitHub Actions secret was removed from an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -6391,21 +9667,31 @@ "description": "A GitHub Actions variable was removed from an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -6414,18 +9700,29 @@ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "user_id", - "user_agent", - "org_id", - "user", - "action", - "_document_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" @@ -6435,19 +9732,29 @@ "description": "Removed a two-factor authentication method restriction for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "two_factor_method", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "two_factor_method", "created_at", "operation_type", "actor_is_bot" @@ -6458,22 +9765,32 @@ "description": "A Codespaces or Dependabot secret was removed from an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -6481,21 +9798,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6503,21 +9829,30 @@ "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ - "org", - "user", - "org_id", - "created_at", - "request_id", "@timestamp", - "action", - "operation_type", - "user_agent", "_document_id", + "action", "actor", "actor_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6525,21 +9860,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", - "org", - "team", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "programmatic_access_type" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type" ] }, { @@ -6547,18 +9892,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", "fields": [ - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "actor", - "action", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -6567,19 +9924,31 @@ "description": "An organization was renamed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "_document_id", "@timestamp", - "org", + "_document_id", "action", "actor", - "old_login", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_login", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -6587,14 +9956,28 @@ "description": "Triggered when a required workflow is created.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6605,14 +9988,28 @@ "description": "Triggered when a required workflow is deleted.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6623,14 +10020,28 @@ "description": "Triggered when a required workflow is updated.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6641,20 +10052,30 @@ "description": "An organization member was restored.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", "fields": [ - "user", - "actor", - "user_id", + "@timestamp", "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "actor_id", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" }, @@ -6663,18 +10084,29 @@ "description": "A member's linked identity was revoked.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", "user_id", - "@timestamp", - "action", - "actor_id", "user_agent", - "_document_id", - "request_id", + "operation_type", "created_at" ], "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" @@ -6684,19 +10116,30 @@ "description": "A member's SAML session was revoked.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", "fields": [ - "actor_id", - "created_at", - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" }, @@ -6705,21 +10148,33 @@ "description": "A self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" @@ -6729,21 +10184,31 @@ "description": "A self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6752,20 +10217,31 @@ "description": "A self-hosted runner group was renamed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6774,23 +10250,33 @@ "description": "The REST API was used to remove a self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -6799,23 +10285,31 @@ "description": "A self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6824,19 +10318,32 @@ "description": "A runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -6845,25 +10352,36 @@ "description": "The configuration of a self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6872,21 +10390,32 @@ "description": "The visibility of a self-hosted runner group was updated via the REST API.", "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", - "visibility", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" }, @@ -6895,21 +10424,30 @@ "description": "Automatic partner validation checks have been disabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -6919,21 +10457,30 @@ "description": "Automatic partner validation checks have been enabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -6943,20 +10490,30 @@ "description": "A custom pattern was created for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6965,22 +10522,30 @@ "description": "A custom pattern was removed from secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -6989,21 +10554,30 @@ "description": "A custom pattern was published for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7012,21 +10586,30 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7035,22 +10618,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7059,21 +10650,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7082,22 +10682,30 @@ "description": "Generic secrets have been disabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -7105,22 +10713,30 @@ "description": "Generic secrets have been enabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -7128,21 +10744,30 @@ "description": "Secret scanning for non-provider patterns was disabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7152,21 +10777,30 @@ "description": "Secret scanning for non-provider patterns was enabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7176,19 +10810,30 @@ "description": "A role or team was added to the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7198,21 +10843,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7222,21 +10876,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7246,19 +10909,30 @@ "description": "A role or team was removed from the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7268,22 +10942,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7292,22 +10974,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7316,22 +11006,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7340,21 +11038,30 @@ "description": "Push protection for secret scanning was disabled.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7363,21 +11070,30 @@ "description": "Push protection for secret scanning was enabled.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7386,22 +11102,30 @@ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7410,22 +11134,30 @@ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7434,26 +11166,35 @@ "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -7462,26 +11203,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7489,28 +11238,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7518,26 +11275,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7545,15 +11310,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -7562,15 +11344,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -7579,7 +11378,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -7594,20 +11414,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -7616,16 +11447,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -7636,18 +11480,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -7656,17 +11513,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", "_document_id", - "org_id", - "operation_type", + "action", "actor", "actor_id", - "@timestamp", - "request_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", - "action" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7674,18 +11544,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -7694,18 +11576,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -7714,18 +11609,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -7734,22 +11641,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", "actor_id", - "org_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issuer", - "business", "operation_type", "created_at", - "request_id", - "business_id", - "_document_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7757,21 +11674,32 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Adding organizations to your enterprise" }, @@ -7780,19 +11708,30 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -7803,15 +11742,28 @@ "description": "The organization was unarchived.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7821,19 +11773,32 @@ "description": "A user was unblocked from an organization.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", "fields": [ - "oauth_application_id", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", - "@timestamp", - "request_id", - "created_at", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "blocked_user", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" }, @@ -7842,20 +11807,32 @@ "description": "A GitHub Actions secret was updated for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "created_at", "key", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -7864,23 +11841,34 @@ "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "updated_allowed_types", "old_policy", - "updated_access_policy", - "programmatic_access_type", - "request_access_security_header" + "updated_access_policy" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" }, @@ -7889,20 +11877,32 @@ "description": "A GitHub Actions variable was updated for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -7911,20 +11911,32 @@ "description": "The default repository permission level for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", + "created_at", "permission", - "actor_id", - "old_permission", - "_document_id", - "programmatic_access_type" + "old_permission" ] }, { @@ -7932,22 +11944,33 @@ "description": "A Codespaces or Dependabot secret was updated for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -7956,20 +11979,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -7977,17 +12011,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -7997,20 +12044,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -8019,36 +12077,62 @@ "description": "The name of the default branch was changed for new repositories in the organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" - }, - { + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" + }, + { "action": "org.update_repo_self_hosted_runners_policy", "description": "The repository self-hosted runners policy was updated", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_repo_runners_policy", "new_repo_runners_policy", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8059,19 +12143,32 @@ "description": "An organization's SAML provider settings were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "sso_url", - "actor_id", - "operation_type", "@timestamp", - "issuer", - "org", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "operation_type", + "issuer", + "created_at" ] }, { @@ -8079,18 +12176,30 @@ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", "fields": [ - "request_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "_document_id", - "org", - "action", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" }, @@ -8099,18 +12208,30 @@ "description": "A default label was created for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", "fields": [ - "request_id", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", - "_document_id", - "action", - "created_at", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" }, @@ -8119,17 +12240,30 @@ "description": "A default label was deleted for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", "fields": [ - "operation_type", - "request_id", - "actor", "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" }, @@ -8138,17 +12272,30 @@ "description": "A default label was edited for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", "fields": [ - "org", - "created_at", "@timestamp", - "actor", + "_document_id", "action", - "user_agent", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" }, @@ -8157,20 +12304,33 @@ "description": "A domain was approved for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "org_id", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" }, @@ -8179,16 +12339,31 @@ "description": "A domain was added to an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "created_at", + "@timestamp", "_document_id", - "domain_name", "action", - "request_id", + "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "domain_name", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8197,14 +12372,29 @@ "description": "A domain was removed from an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", "fields": [ - "action", - "domain_name", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "domain_name", "operation_type", "created_at" ], @@ -8215,16 +12405,31 @@ "description": "A domain was verified for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "operation_type", - "domain_name", "@timestamp", - "user_agent", - "request_id", - "actor", - "action", - "created_at", "_document_id", - "actor_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "domain_name", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8233,16 +12438,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -8252,17 +12470,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -8272,16 +12501,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -8291,20 +12533,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -8312,19 +12564,30 @@ "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor", - "business_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", "user_agent", - "_document_id", "created_at", - "operation_type", - "request_id", - "business" + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -8333,19 +12596,30 @@ "description": "Organization projects were disabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "operation_type", - "@timestamp", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -8354,18 +12628,29 @@ "description": "Organization projects were enabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor_id", - "org_id", - "created_at", - "user_id", - "org", "@timestamp", "_document_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", + "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" @@ -8375,23 +12660,33 @@ "description": "An organization role was assigned to a user or team.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About custom organization roles" }, @@ -8400,25 +12695,32 @@ "description": "A custom organization role was created in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8430,25 +12732,32 @@ "description": "A custom organization role was deleted in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8459,19 +12768,30 @@ "description": "A user or team was unassigned an organization role.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type" ], @@ -8482,26 +12802,33 @@ "description": "A custom organization role was edited in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", "old_role_permissions", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -8514,22 +12841,33 @@ "description": "An organization's default project base role was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_project_base_role", - "new_project_base_role", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_project_base_role", + "new_project_base_role", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8537,20 +12875,31 @@ "description": "An entire package was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" @@ -8560,23 +12909,34 @@ "description": "A package was published or republished to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "ecosystem", "version_count", "is_republished", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -8585,21 +12945,32 @@ "description": "A specific package version was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "version", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "ecosystem", "actor_is_bot" ], @@ -8610,21 +12981,34 @@ "description": "A specific package version was published or republished to a package.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "ecosystem", "package", "version", - "actor_id", - "user_agent", "is_republished", - "actor", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -8633,20 +13017,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -8655,20 +13053,35 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", - "owner_type", - "domain", - "state", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type" - ], + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", + "owner_type", + "domain", + "state", + "created_at", + "operation_type" + ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, { @@ -8676,20 +13089,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -8698,18 +13125,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8717,16 +13156,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8734,18 +13187,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8753,18 +13218,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8775,22 +13253,31 @@ "description": "The configured restriction for access to resources via personal access tokens was disabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8798,22 +13285,31 @@ "description": "The configured restriction for access to resources via personal access tokens was enabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8821,18 +13317,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8843,18 +13352,28 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -8865,18 +13384,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -8887,23 +13416,34 @@ "description": "A personal access token expiration limit was set.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "token_expiration", "old_token_expiration", "exempt_administrators", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8911,21 +13451,32 @@ "description": "A personal access token expiration limit was unset.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "programmatic_access_type", - "old_token_expiration", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_token_expiration", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8933,17 +13484,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8954,18 +13518,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8977,17 +13554,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -8999,20 +13589,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was created.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9024,20 +13623,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9049,20 +13657,29 @@ "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9074,20 +13691,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9099,15 +13725,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9117,17 +13758,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -9137,15 +13789,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9155,19 +13822,30 @@ "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "action", - "operation_type", "@timestamp", - "business_id", + "_document_id", + "action", + "actor", "actor_id", - "user", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9175,23 +13853,30 @@ "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "created_at", - "actor_id", + "@timestamp", "_document_id", - "actor", - "user", - "repo", "action", - "user_agent", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "request_id", - "user_id", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -9199,23 +13884,30 @@ "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_id", - "operation_type", + "@timestamp", "_document_id", "action", - "@timestamp", - "repo", - "org", - "business", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org_id", - "created_at", - "business_id" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9223,17 +13915,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9243,17 +13946,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9263,17 +13977,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9283,17 +14008,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9303,17 +14039,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -9323,17 +14072,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9341,25 +14103,36 @@ "description": "A project's base role was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_project_base_role", "new_project_base_role", "project_number", "public_project", - "business", "project_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9367,20 +14140,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -9390,25 +14174,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -9416,20 +14212,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9437,25 +14245,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9463,17 +14283,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -9481,17 +14314,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -9499,18 +14345,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -9519,18 +14377,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -9539,19 +14409,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -9559,17 +14440,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -9581,22 +14475,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -9604,19 +14507,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -9624,17 +14538,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9642,18 +14569,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -9661,20 +14601,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9682,38 +14632,62 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" - }, - { - "action": "project_view.delete", - "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", - "fields": [ - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + }, + { + "action": "project_view.delete", + "description": "A view was deleted in a project board.", + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -9722,16 +14696,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -9743,21 +14730,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -9765,22 +14764,32 @@ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", "fields": [ - "repo", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "name", "created_at", - "_document_id", "operation_type", - "actor", - "repo_id", - "org", - "request_id", - "actor_id", - "oauth_application_id", - "@timestamp", - "programmatic_access_type" + "oauth_application_id" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" }, @@ -9789,29 +14798,34 @@ "description": "A protected branch allowance was given to a specific user, team or integration.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "authorized_actors", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -9819,24 +14833,32 @@ "description": "Branch protection was enabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "repo_id", - "user_id", "@timestamp", - "user_agent", - "repo", - "name", - "org_id", - "user", "_document_id", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", "created_at", "authorized_actor_names", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -9847,21 +14869,31 @@ "description": "Branch protection was disabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "repo", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", - "request_id", - "repo_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "name", + "operation_type", "created_at", - "_document_id", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -9872,22 +14904,32 @@ "description": "Enforcement of dismissing stale pull requests was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "dismiss_stale_reviews_on_push", - "org_id", - "action", - "created_at", - "request_id", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismiss_stale_reviews_on_push", + "created_at", "operation_type", - "actor", - "repo", - "org", - "name", - "programmatic_access_type" + "name" ] }, { @@ -9895,24 +14937,34 @@ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "authorized_actors_only", "authorized_actors", "created_at", - "user_agent", "name", - "_document_id", - "org_id", - "request_id", - "@timestamp", - "actor_id", - "org", - "action", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -9920,30 +14972,37 @@ "description": "A branch protection requirement was overridden by a repository administrator.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "actor", "reasons", - "@timestamp", "before", "after", - "actor_id", - "repo", "operation_type", - "user_agent", "branch", "overridden_codes", - "org", - "org_id", - "action", - "_document_id", - "request_id", "referrer", - "business", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "rule_suite_id" ] @@ -9953,28 +15012,36 @@ "description": "A branch update attempt was rejected.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "request_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "branch", "before", "overridden_codes", "after", - "action", "reasons", - "actor_id", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "actor_is_bot", "rule_suite_id" @@ -9985,23 +15052,32 @@ "description": "Branch protection was enforced for repository administrators.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "admin_enforced", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "name", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "action", "repo_id", - "org_id", - "_document_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "admin_enforced", + "operation_type", + "name", + "created_at" ] }, { @@ -10009,22 +15085,32 @@ "description": "Branch deletion was enabled or disabled for a protected branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "operation_type", - "request_id", - "repo", "@timestamp", - "org_id", - "org", - "action", - "allow_deletions_enforcement_level", "_document_id", - "created_at", - "actor_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_deletions_enforcement_level", + "created_at" ] }, { @@ -10032,23 +15118,32 @@ "description": "Force pushes were enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "actor_id", - "name", + "@timestamp", "_document_id", + "action", "actor", - "repo", - "operation_type", - "request_id", - "allow_force_pushes_enforcement_level", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_force_pushes_enforcement_level", + "created_at" ] }, { @@ -10056,24 +15151,33 @@ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "ignore_approvals_from_contributors", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -10082,22 +15186,32 @@ "description": "Required linear commit history was enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "operation_type", "actor", - "linear_history_requirement_enforcement_level", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "linear_history_requirement_enforcement_level", "name", - "org_id", - "repo_id", - "org", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ] }, { @@ -10105,24 +15219,33 @@ "description": "Fork syncing was enabled or disabled for a read-only branch", "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "lock_allows_fetch_and_merge", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "lock_allows_fetch_and_merge", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -10131,27 +15254,34 @@ "description": "The enforcement of a branch lock was updated.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "enforcement_level", "lock_branch_enforcement_level", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -10160,18 +15290,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -10182,24 +15325,33 @@ "description": "A branch name pattern was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "old_name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "old_name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -10207,25 +15359,32 @@ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", "docs_reference_links": "N/A", "fields": [ - "name", - "org_id", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "@timestamp", + "business", "business_id", - "request_id", - "pull_request_reviews_enforcement_level", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "business", - "user_agent", - "created_at", "repo_id", - "operation_type", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "pull_request_reviews_enforcement_level", + "created_at", + "operation_type" ] }, { @@ -10233,22 +15392,32 @@ "description": "Enforcement of required code owner review was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "created_at", - "require_code_owner_review", - "operation_type", - "name", - "user_agent", - "action", "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "request_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "require_code_owner_review", + "operation_type", + "name" ] }, { @@ -10256,22 +15425,33 @@ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "require_last_push_approval", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" }, @@ -10280,22 +15460,32 @@ "description": "Enforcement of the required number of approvals before merging was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "required_approving_review_count", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "required_approving_review_count", "created_at", - "actor", "operation_type", - "user_agent", - "name", - "org_id", - "action", - "actor_id", - "_document_id", - "org", - "@timestamp", - "programmatic_access_type" + "name" ] }, { @@ -10303,25 +15493,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "user_agent", "@timestamp", "_document_id", - "name", - "repo", "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "business", - "actor_id", - "operation_type", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "required_status_checks_enforcement_level", - "org", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "required_status_checks_enforcement_level" ] }, { @@ -10329,22 +15526,32 @@ "description": "Enforcement of required commit signing was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "name", "@timestamp", - "created_at", "_document_id", - "request_id", - "repo_id", - "org", - "org_id", "action", "actor", "actor_id", - "signature_requirement_enforcement_level", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "programmatic_access_type" + "operation_type", + "name", + "created_at", + "signature_requirement_enforcement_level" ] }, { @@ -10352,22 +15559,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "created_at", - "repo_id", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "name", - "actor", - "repo", "operation_type", - "action", - "strict_required_status_checks_policy", - "programmatic_access_type" + "strict_required_status_checks_policy" ] }, { @@ -10375,23 +15592,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -10400,24 +15628,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -10426,20 +15665,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10448,21 +15701,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -10472,22 +15738,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10496,25 +15774,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10523,23 +15811,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", - "created_at", - "key", - "fingerprint", - "actor_id", "actor", - "title", - "user_agent", - "user_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "read_only", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "key", + "fingerprint", + "title", + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10548,18 +15847,32 @@ "description": "A pull request was closed without being merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" @@ -10569,21 +15882,32 @@ "description": "A pull request was converted to a draft.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" }, @@ -10592,19 +15916,32 @@ "description": "A pull request was created.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -10615,23 +15952,35 @@ "description": "A review was requested on a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -10641,17 +15990,31 @@ "description": "A pull request was marked as in progress.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -10659,19 +16022,32 @@ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -10679,19 +16055,32 @@ "description": "A pull request was merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" @@ -10701,21 +16090,32 @@ "description": "A pull request was marked as ready for review.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" }, @@ -10724,27 +16124,34 @@ "description": "A pull request was rebased.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", - "pull_request_url", - "pull_request_title", - "user", - "user_id", - "repo", - "repo_id", - "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", + "pull_request_url", + "pull_request_title", + "public_repo", + "created_at", + "operation_type" ] }, { @@ -10752,23 +16159,35 @@ "description": "A review request was removed from a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" }, @@ -10777,18 +16196,32 @@ "description": "A pull request was reopened after previously being closed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -10796,19 +16229,31 @@ "description": "A review comment was added to a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "comment_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -10818,20 +16263,31 @@ "description": "A review comment on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", "@timestamp", "_document_id", - "repo", - "created_at", - "request_id", - "comment_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "comment_id", + "operation_type" ] }, { @@ -10839,18 +16295,31 @@ "description": "A review comment on a pull request was changed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "request_id", - "actor_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "_document_id", - "@timestamp", - "comment_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "comment_id" ] }, { @@ -10858,21 +16327,33 @@ "description": "A review on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ] }, { @@ -10880,20 +16361,33 @@ "description": "A review on a pull request was dismissed.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" }, @@ -10902,19 +16396,33 @@ "description": "A review on a pull request was submitted.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" @@ -10924,22 +16432,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", - "actor_id", - "user_id", - "created_at", - "user_agent", - "actor", + "_document_id", "action", - "repo", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -10948,21 +16466,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -10971,25 +16498,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -10998,23 +16532,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -11023,24 +16565,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -11049,23 +16598,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -11075,22 +16632,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -11099,19 +16665,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -11120,24 +16699,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -11146,24 +16735,32 @@ "description": "Autofix for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "public_repo", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11171,24 +16768,32 @@ "description": "Autofix for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11196,24 +16801,32 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11221,24 +16834,32 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11246,23 +16867,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -11273,17 +16903,29 @@ "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -11293,17 +16935,29 @@ "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -11313,25 +16967,31 @@ "description": "Code scanning using the default setup was disabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -11340,26 +17000,34 @@ "description": "Code scanning using the default setup was enabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "query_suite", "threat_model", - "languages", - "request_access_security_header" + "languages" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -11368,25 +17036,34 @@ "description": "Code scanning using the default setup was updated for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "query_suite", - "threat_model", - "languages", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "query_suite", + "threat_model", + "languages", + "public_repo", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Configuring default setup for code scanning" @@ -11396,19 +17073,30 @@ "description": "GitHub Codespaces was granted trusted repository access to this repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -11417,19 +17105,30 @@ "description": "GitHub Codespaces trusted repository access to this repository was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11437,17 +17136,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11456,15 +17168,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -11475,16 +17200,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11494,17 +17232,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11514,19 +17265,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11535,17 +17297,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11554,26 +17329,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -11582,30 +17363,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -11615,20 +17401,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -11637,25 +17434,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -11664,23 +17469,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -11688,25 +17504,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -11716,23 +17541,32 @@ "description": "A source code archive of a repository was downloaded as a ZIP file.", "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "created_at", "operation_type", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" @@ -11742,23 +17576,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -11766,21 +17610,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -11788,21 +17642,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", - "action", - "request_id", - "user", - "repo", - "user_agent", - "_document_id", - "actor_id", "@timestamp", + "_document_id", + "action", "actor", - "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -11810,22 +17674,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -11833,21 +17706,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -11855,20 +17738,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11876,22 +17770,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -11899,18 +17802,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -11918,22 +17835,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -11941,21 +17868,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -11963,18 +17900,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -11983,22 +17932,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", "key", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12007,24 +17965,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12033,23 +17999,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -12057,26 +18033,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -12085,21 +18066,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -12108,25 +18098,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -12134,22 +18130,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -12158,25 +18164,34 @@ "description": "A branch was renamed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "old_branch", - "new_branch", - "default_branch", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "old_branch", + "new_branch", + "default_branch", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch" @@ -12186,19 +18201,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -12206,17 +18232,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -12225,17 +18266,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -12244,7 +18300,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -12259,23 +18336,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -12285,20 +18371,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -12309,21 +18406,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -12332,22 +18440,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -12356,21 +18474,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -12379,22 +18508,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -12405,16 +18544,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -12424,22 +18574,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -12448,23 +18609,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -12474,19 +18645,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -12494,21 +18675,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -12517,24 +18708,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -12542,25 +18742,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12569,24 +18776,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12595,25 +18812,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12622,22 +18847,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", + "user_agent", + "visibility", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -12646,26 +18880,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -12673,31 +18915,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -12706,22 +18955,30 @@ "description": "Someone closed a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", "fields": [ - "actor", - "repo", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "user_agent", - "actor_id", - "request_id", - "action", - "operation_type", - "created_at", - "repo_id", - "_document_id", + "hashed_token", "org", "org_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "About repository security advisories" }, @@ -12730,18 +18987,29 @@ "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "repo", - "org_id", - "actor", + "@timestamp", + "_document_id", "action", - "request_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "_document_id", + "operation_type", "created_at" ] }, @@ -12750,17 +19018,30 @@ "description": "GitHub made a security advisory public in the GitHub Advisory Database.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -12769,21 +19050,30 @@ "description": "GitHub withdrew a security advisory that was published in error.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -12791,18 +19081,30 @@ "description": "Someone opened a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", "repo_id", - "action", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -12810,21 +19112,30 @@ "description": "Someone published a security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", "@timestamp", - "actor", - "repo_id", "_document_id", - "repo", - "business_id", - "business", - "request_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "org" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -12832,17 +19143,30 @@ "description": "Someone reopened as draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "repo", - "action", - "created_at", "@timestamp", - "request_id", - "actor_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "public_repo" ] }, @@ -12851,21 +19175,30 @@ "description": "Someone edited a draft or published security advisory.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "repo_id", - "org_id", "business", - "actor", - "user_agent", - "created_at", - "_document_id", "business_id", - "repo", - "action", - "operation_type", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -12873,24 +19206,30 @@ "description": "Branch protections were disabled for the repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -12899,24 +19238,30 @@ "description": "Branch protections were enabled for this repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -12925,25 +19270,31 @@ "description": "Code security was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -12952,25 +19303,31 @@ "description": "Code security was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -12979,19 +19336,30 @@ "description": "Data use settings were disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "repo_id", - "request_id", - "actor_id", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -13000,21 +19368,30 @@ "description": "Data use settings were enabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "org", - "user_id", - "repo_id", "@timestamp", - "request_id", - "actor", + "_document_id", "action", - "operation_type", - "created_at", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org_id", - "_document_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -13023,23 +19400,30 @@ "description": "The dependency graph was disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "repo_id", - "operation_type", - "user_id", - "repo", + "@timestamp", "_document_id", - "actor", - "user", "action", - "@timestamp", - "org_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", - "request_id", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -13048,24 +19432,31 @@ "description": "The dependency graph was enabled for a private repository.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor_id", - "repo_id", + "created_at", "operation_type", - "actor", - "@timestamp", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13074,21 +19465,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -13096,21 +19497,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -13118,21 +19529,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -13140,20 +19562,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -13161,21 +19595,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -13183,19 +19628,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -13203,17 +19661,31 @@ "description": "An organization has reached their repository limit.", "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "limit", "count", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -13224,17 +19696,31 @@ "description": "An organization is approaching their repository limit.", "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "limit", "count", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -13245,19 +19731,30 @@ "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", "fields": [ - "request_id", - "created_at", + "@timestamp", "_document_id", "action", - "user_agent", - "user", - "business_id", - "business", - "operation_type", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -13266,20 +19763,30 @@ "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "created_at", "@timestamp", - "repo", - "action", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "repo_id", - "actor", - "request_id", - "programmatic_access_type" + "created_at", + "operation_type" ] }, { @@ -13288,20 +19795,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", "created_at", - "org_id", - "action", - "user_id", - "operation_type", - "_document_id", - "actor_id", - "repo" + "operation_type" ] }, { @@ -13309,31 +19825,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -13342,19 +19866,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -13362,8 +19897,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -13372,23 +19906,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -13413,26 +19956,32 @@ "description": "Automatic partner validation checks have been disabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -13441,26 +19990,32 @@ "description": "Automatic partner validation checks have been enabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -13469,23 +20024,30 @@ "description": "A custom pattern was created for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13495,23 +20057,30 @@ "description": "A custom pattern was removed from secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13521,24 +20090,31 @@ "description": "A custom pattern was published for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13548,24 +20124,31 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -13574,24 +20157,31 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13601,23 +20191,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13627,23 +20224,31 @@ "description": "Secret scanning was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "public_repo", - "programmatic_access_type" + "public_repo" ], "docs_reference_titles": "About secret scanning" }, @@ -13652,22 +20257,30 @@ "description": "Secret scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13675,24 +20288,32 @@ "description": "Generic secrets have been disabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13700,22 +20321,31 @@ "description": "Generic secrets have been enabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -13724,24 +20354,32 @@ "description": "Secret scanning for non-provider patterns was disabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -13750,24 +20388,32 @@ "description": "Secret scanning for non-provider patterns was enabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -13776,19 +20422,31 @@ "description": "A role or team was added to the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -13797,24 +20455,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -13823,24 +20489,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -13849,19 +20523,31 @@ "description": "A role or team was removed from the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -13870,26 +20556,31 @@ "description": "Secret scanning push protection was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -13898,26 +20589,31 @@ "description": "Secret scanning push protection was enabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -13926,28 +20622,36 @@ "description": "A code security configuration was applied to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -13955,27 +20659,35 @@ "description": "A code security configuration failed to attach to the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -13983,28 +20695,36 @@ "description": "A code security configuration was removed from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14012,28 +20732,36 @@ "description": "A code security configuration was removed due to a change in repository or enterprise settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14041,20 +20769,30 @@ "description": "The repository visibility change setting was cleared for an organization or enterprise.", "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", "fields": [ - "created_at", + "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", "business", - "action", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business_id", - "@timestamp", "user_agent", - "actor", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise" }, @@ -14063,20 +20801,30 @@ "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user", - "org_id", - "created_at", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "_document_id", - "@timestamp", - "user_id", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14084,19 +20832,30 @@ "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "_document_id", "@timestamp", - "user_agent", - "user", - "created_at", - "org", - "org_id", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14104,29 +20863,37 @@ "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -14135,29 +20902,37 @@ "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -14166,19 +20941,32 @@ "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ - "operation_type", - "request_id", - "repo_id", "@timestamp", - "user_agent", - "alert_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "alert_id", + "created_at", + "alert_number" ], "docs_reference_titles": "About Dependabot alerts" }, @@ -14187,23 +20975,32 @@ "description": "A Dependabot alert was manually dismissed.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_id", - "@timestamp", - "operation_type", "user_agent", + "operation_type", "alert_id", - "actor", - "repo", "created_at", - "org", - "_document_id", - "action", - "actor_id", "dismiss_reason", - "user", "dismiss_comment", "alert_number", "actor_is_bot" @@ -14214,21 +21011,33 @@ "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "public_repo", "owner", - "_document_id", - "@timestamp", "operation_type", - "token_scopes", "alert_number" ] }, @@ -14237,26 +21046,34 @@ "description": "A Dependabot alert was manually reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type", - "business", - "business_id", "public_repo", - "alert_number", - "request_access_security_header" + "alert_number" ] }, { @@ -14264,21 +21081,32 @@ "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", "docs_reference_links": "N/A", "fields": [ - "alert_id", - "repo", - "operation_type", - "action", - "repo_id", - "_document_id", - "user_agent", - "request_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "alert_id", + "operation_type", + "created_at", + "alert_number" ] }, { @@ -14286,21 +21114,35 @@ "description": "A Dependabot alert was withdrawn.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", "created_at", "active", - "action", - "repository_id", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type" ] }, @@ -14309,20 +21151,30 @@ "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", "fields": [ - "org", + "@timestamp", "_document_id", - "repo", - "org_id", - "operation_type", - "created_at", - "actor", "action", - "@timestamp", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" }, @@ -14331,24 +21183,31 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -14356,26 +21215,32 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14383,23 +21248,30 @@ "description": "Dependabot alerts was disabled.", "docs_reference_links": "N/A", "fields": [ - "repo", - "request_id", - "repo_id", - "action", - "actor_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "_document_id", "user_id", - "operation_type", - "token_scopes", - "programmatic_access_type" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14407,23 +21279,30 @@ "description": "Dependabot alerts was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_agent", - "created_at", "@timestamp", - "repo_id", + "_document_id", "action", - "user", - "repo", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor_id", - "_document_id", - "user_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot" ] }, @@ -14432,24 +21311,31 @@ "description": "A status check was marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "org", - "actor_id", "@timestamp", - "business", - "request_id", - "context", - "repo_id", - "action", - "repo", "_document_id", - "operation_type", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "actor", - "created_at", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "context", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -14458,21 +21344,31 @@ "description": "A status check was no longer marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "actor_id", - "actor", - "created_at", - "context", - "operation_type", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "repo_id", "org_id", - "action", - "_document_id", + "programmatic_access_type", "repo", - "programmatic_access_type" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "context", + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -14481,18 +21377,31 @@ "description": "Email notification restrictions for an organization or enterprise were disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -14501,19 +21410,31 @@ "description": "Email notification restrictions for an organization or enterprise were enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -14522,22 +21443,33 @@ "description": "A new custom repository role was created.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "owner", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", - "_document_id", "role_permissions", "old_role_permissions" ], @@ -14548,23 +21480,34 @@ "description": "A custom repository role was deleted.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Managing custom repository roles for an organization" }, @@ -14573,23 +21516,34 @@ "description": "A custom repository role was edited.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "old_role_permissions", "old_base_role" ], @@ -14600,14 +21554,28 @@ "description": "GitHub detected a secret and created a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -14621,14 +21589,28 @@ "description": "A secret scanning alert was leaked in a public repo.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -14643,22 +21625,32 @@ "description": "A secret scanning alert was reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type_display_name" ] }, @@ -14667,14 +21659,28 @@ "description": "A leaked secret was reported to the secret's provider by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "created_at", @@ -14689,28 +21695,37 @@ "description": "A secret scanning alert was resolved.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "resolution", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", + "resolution", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type", "secret_type_display_name", "publicly_leaked", - "multi_repo", - "request_access_security_header" + "multi_repo" ] }, { @@ -14718,25 +21733,32 @@ "description": "A secret scanning alert was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -14744,14 +21766,28 @@ "description": "A secret scanning alert was validated.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "previous_validity", @@ -14768,26 +21804,34 @@ "description": "A request to close a secret scanning alert was approved by a user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "request_reviewer_comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14796,25 +21840,33 @@ "description": "N/A", "docs_reference_links": "A reqeust to close a secret scanning alert was canceled by a user.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "A, reqeust, to, close, a, secret, scanning, alert, was, canceled, by, a, user." @@ -14824,27 +21876,35 @@ "description": "N/A", "docs_reference_links": "A user requested to close a secret scanning alert.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "reason", "comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "A, user, requested, to, close, a, secret, scanning, alert." @@ -14854,26 +21914,34 @@ "description": "A request to close a secret scanning alert was denied by a user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "request_reviewer_comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14882,19 +21950,30 @@ "description": "Secret scanning was disabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -14903,19 +21982,30 @@ "description": "Secret scanning was enabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -14924,20 +22014,30 @@ "description": "Secret scanning was disabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -14946,19 +22046,30 @@ "description": "Secret scanning was enabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -14967,14 +22078,28 @@ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "push_protection_bypass_reason", @@ -14992,25 +22117,33 @@ "description": "A request to bypass secret scanning push protection was approved by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -15019,24 +22152,32 @@ "description": "A user canceled a request to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" @@ -15046,24 +22187,32 @@ "description": "A user pushed a commit containing a secret for which there is an approved secret scanning push protection bypass request.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" @@ -15073,25 +22222,33 @@ "description": "A request to bypass secret scanning push protection was denied by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", - "request_access_security_header", "request_reviewer_comment" ], "docs_reference_titles": "About push protection" @@ -15101,25 +22258,33 @@ "description": "A user requested to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" }, @@ -15128,22 +22293,35 @@ "description": "A secret scanning scan has completed on this repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "repo_id", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "source", "type", "source_slug", "type_slug", "started_at", "completed_at", - "repo", "public_repo", - "org", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "secret_types", @@ -15157,10 +22335,28 @@ "description": "A security configuration was created", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15175,15 +22371,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -15201,22 +22390,33 @@ "description": "A default security configuration setting for new repositories was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15225,22 +22425,33 @@ "description": "A default security configuration setting for new repositories was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15249,10 +22460,28 @@ "description": "A security configuration was deleted", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15267,15 +22496,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -15292,15 +22514,30 @@ "description": "A security configuration policy was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enforcement", "security_configuration_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15310,10 +22547,28 @@ "description": "A security configuration was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15328,15 +22583,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -15354,16 +22602,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15373,18 +22634,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -15393,16 +22667,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15412,15 +22699,28 @@ "description": "An agreement for invoiced billing for GitHub Sponsors was signed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -15432,15 +22732,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -15450,15 +22763,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -15467,17 +22795,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -15486,17 +22827,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -15505,16 +22860,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -15524,14 +22892,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -15541,17 +22924,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -15559,18 +22955,31 @@ "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", - "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", + "fields": [ "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -15579,18 +22988,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15599,15 +23021,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -15617,16 +23053,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -15634,15 +23083,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -15653,16 +23115,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -15672,17 +23147,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -15693,17 +23181,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -15714,18 +23215,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15735,16 +23247,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15754,16 +23279,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15775,17 +23313,30 @@ "fields": [ "@timestamp", "_document_id", - "fingerprint", - "operation_type", - "openssh_public_key", - "org_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "request_id" + "fingerprint", + "operation_type", + "openssh_public_key", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15794,19 +23345,32 @@ "description": "An SSH certificate authority for an organization or enterprise was deleted.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "created_at", + "@timestamp", "_document_id", - "fingerprint", - "operation_type", + "action", "actor", - "org_id", - "openssh_public_key", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", - "request_id" + "created_at", + "fingerprint", + "operation_type", + "openssh_public_key" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15815,21 +23379,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "user", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "request_id", - "org", - "org_id", - "created_at", - "actor", "action", - "user_id", + "actor", + "actor_id", "business", "business_id", - "@timestamp", - "actor_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15838,19 +23411,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "actor_id", - "user_id", - "org", - "operation_type", - "request_id", "@timestamp", "_document_id", - "actor", - "user", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -15859,15 +23443,28 @@ "description": "Dependabot encrypted config was read.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "public_repo" @@ -15878,20 +23475,34 @@ "description": "The verification code expiry time for an organization or enterprise domain was set.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "token_expires_at", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15899,18 +23510,33 @@ "description": "An organization or enterprise domain was unverified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ] }, { @@ -15918,16 +23544,31 @@ "description": "An organization or enterprise domain was verified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "domain_name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15935,23 +23576,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15959,23 +23610,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -15983,23 +23644,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16007,23 +23678,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16031,21 +23712,31 @@ "description": "A member of an organization was added to a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", "fields": [ - "user_agent", - "request_id", - "org_id", - "user_id", - "team", - "user", "@timestamp", - "actor_id", - "created_at", - "operation_type", "_document_id", - "org", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" @@ -16055,22 +23746,31 @@ "description": "A team was given access and permissions to a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "team", - "action", - "operation_type", - "request_id", - "created_at", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "actor_id", - "_document_id", "repo_id", - "user_agent", - "org_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -16079,20 +23779,31 @@ "description": "A child team was created or a child team's parent was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", "fields": [ - "org", "@timestamp", - "created_at", "_document_id", - "team", "action", - "operation_type", "actor", - "request_id", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", + "operation_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" }, @@ -16101,18 +23812,31 @@ "description": "A team's privacy level was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", "fields": [ - "user_agent", - "request_id", - "org", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", "created_at", "operation_type", - "actor_id", - "org_id", - "@timestamp", - "actor", - "_document_id", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" @@ -16122,21 +23846,32 @@ "description": "A new team is created.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "oauth_application_id", + "operation_type", "team", - "org", - "actor", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "team_type" ] }, @@ -16145,21 +23880,31 @@ "description": "A user was demoted from a team maintainer to a team member.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" }, @@ -16168,19 +23913,31 @@ "description": "A team was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "team", "org_id", - "actor_id", - "actor", - "action", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", "operation_type", - "_document_id", - "programmatic_access_type", "team_type" ] }, @@ -16189,19 +23946,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "business_id", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", "actor_id", - "user", "business", - "action", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16209,19 +23977,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "operation_type", - "request_id", "actor", - "org", - "created_at", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", - "_document_id" + "operation_type", + "created_at" ] }, { @@ -16229,18 +24008,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", "@timestamp", - "action", "_document_id", - "user_agent", - "user_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business", + "user_id", + "user_agent", "operation_type", - "actor", "created_at" ] }, @@ -16249,19 +24039,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "actor", - "action", - "operation_type", - "team", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "team" ] }, { @@ -16269,19 +24071,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", "@timestamp", - "actor_id", "_document_id", - "team", - "created_at", - "org_id", "action", - "request_id", - "user_agent", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_access_security_header" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "team", + "created_at" ] }, { @@ -16289,22 +24103,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "team", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at" ] }, { @@ -16312,22 +24135,31 @@ "description": "A user was promoted from a team member to a team maintainer.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" }, @@ -16336,22 +24168,31 @@ "description": "An organization member was removed from a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", "fields": [ - "request_id", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "team", - "user_id", - "actor", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", + "user_id", "user_agent", - "_document_id", - "token_scopes", - "programmatic_access_type", + "operation_type", + "created_at", + "team", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" @@ -16359,23 +24200,33 @@ { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A", - "fields": [ - "request_id", - "org_id", - "repo", - "repo_id", - "action", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "created_at", "team", - "org", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -16383,21 +24234,32 @@ "description": "A team's name was changed.", "docs_reference_links": "N/A", "fields": [ - "name", - "user_agent", - "created_at", - "team", - "operation_type", - "actor_id", - "org", + "@timestamp", + "_document_id", "action", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "_document_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "team", + "operation_type", "team_type" ] }, @@ -16406,17 +24268,30 @@ "description": "Team synchronization with a tenant was disabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "request_id", - "org_id", "actor_id", - "operation_type", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -16425,19 +24300,30 @@ "description": "Team synchronization with a tenant was enabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ - "org_id", - "business_id", - "actor", - "created_at", - "user_agent", "@timestamp", - "operation_type", - "business", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -16446,19 +24332,30 @@ "description": "The Okta credentials for team synchronization with a tenant were changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -16466,28 +24363,37 @@ "description": "A team's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "team", - "org_id", "@timestamp", - "org", "_document_id", - "old_permission", - "request_id", - "repo", "action", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "old_permission", "operation_type", "created_at", - "user_agent", "permission", "new_repo_permission", "new_repo_base_role", "old_repo_permission", - "old_repo_base_role", - "token_scopes", - "programmatic_access_type" + "old_repo_base_role" ] }, { @@ -16495,16 +24401,30 @@ "description": "A Dependabot rule was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16514,16 +24434,30 @@ "description": "A Dependabot rule was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16533,18 +24467,31 @@ "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16554,21 +24501,33 @@ "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -16576,21 +24535,32 @@ "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -16598,21 +24568,32 @@ "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -16620,16 +24601,30 @@ "description": "A Dependabot rule's conditions, actions, or metadata changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16639,27 +24634,33 @@ "description": "A workflow job was approved.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", - "repo", - "repo_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -16668,23 +24669,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -16692,10 +24703,28 @@ "description": "A workflow run was cancelled.", "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -16706,20 +24735,9 @@ "run_number", "cancelled_at", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Canceling a workflow run" }, @@ -16728,23 +24746,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16754,10 +24780,28 @@ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -16769,19 +24813,9 @@ "conclusion", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -16792,10 +24826,28 @@ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -16804,21 +24856,10 @@ "head_branch", "head_sha", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "public_repo", - "programmatic_access_type", "actor_is_bot", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "Understanding GitHub Actions" @@ -16828,23 +24869,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -16853,22 +24906,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16876,21 +24940,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -16898,25 +24973,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16924,23 +25007,36 @@ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", "fields": [ - "repo_id", - "repo", - "org_id", - "org", - "business_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "job_name", "runner_labels", "is_hosted_runner", "environment_name", "secrets_passed", - "action", - "_document_id", "operation_type", "created_at", - "@timestamp", "runner_owner_type", "job_workflow_ref", "calling_workflow_refs", @@ -16954,24 +25050,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -16980,10 +25085,28 @@ "description": "A workflow run was re-run.", "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -16993,21 +25116,11 @@ "head_sha", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", "rerun_type", "check_run_id", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "Re-running workflows and jobs" @@ -17017,25 +25130,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.18/user.json b/src/audit-logs/data/ghes-3.18/user.json index 9e80d3b859c4..759542980e5f 100644 --- a/src/audit-logs/data/ghes-3.18/user.json +++ b/src/audit-logs/data/ghes-3.18/user.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,17 +67,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "request_id", "@timestamp", - "user_agent", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", - "user_id", + "token_scopes", "user", - "actor", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -61,18 +98,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", + "token_scopes", "user", - "request_id", - "_document_id", - "user_agent", - "actor", "user_id", - "actor_id", - "operation_type", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -80,18 +129,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "actor_id", - "operation_type", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "token_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -99,29 +160,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -129,18 +196,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -148,17 +227,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -167,19 +259,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -188,18 +292,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -207,18 +324,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -226,15 +355,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -244,26 +386,36 @@ "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -271,24 +423,34 @@ "description": "A CSV export was requested on the \"Coverage\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -296,26 +458,36 @@ "description": "A CSV export was requested on the \"Overview Dashboard\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -323,20 +495,31 @@ "description": "A CSV export was requested on the \"Risk\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -347,17 +530,30 @@ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "created_at", "operation_type" ], @@ -368,20 +564,32 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -390,19 +598,32 @@ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "limit", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -411,19 +632,31 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -432,20 +665,32 @@ "description": "The policy for fork pull request workflows was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -454,19 +699,31 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -475,20 +732,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -497,20 +765,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -521,17 +800,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -539,14 +830,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -556,25 +862,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -585,22 +900,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -612,22 +938,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -636,36 +973,64 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "owner", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "public_repo" - ] - }, + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "owner", + "created_at", + "operation_type", + "public_repo" + ] + }, { "action": "codespaces.restore", "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -675,27 +1040,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "org", "owner", "pull_request_id", "machine_type", - "user_id", - "user", "devcontainer_path", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -703,19 +1077,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -723,18 +1110,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -743,23 +1142,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -767,16 +1173,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -785,24 +1205,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -810,15 +1236,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -828,40 +1267,62 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "request_access_security_header" - ] - }, - { - "action": "copilot.cfb_seat_cancelled", - "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "copilot.cfb_seat_cancelled", + "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -869,21 +1330,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -891,22 +1361,33 @@ "description": "Specific repositories were disabled from using Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "owner_type", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -914,21 +1395,31 @@ "description": "Specific repositories were enabled to use Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "owner_type", - "owner", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -938,20 +1429,32 @@ "description": "Copilot coding agent access was updated for the organization's or user's repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_access", "old_access", - "org_id", "owner_type", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -961,21 +1464,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -985,19 +1497,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1007,21 +1528,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1031,19 +1561,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1052,19 +1593,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1073,19 +1625,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1094,19 +1657,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1115,17 +1689,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1133,19 +1720,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1154,19 +1752,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1174,19 +1783,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1195,19 +1815,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1215,40 +1846,62 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependency_graph.enable", - "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + }, + { + "action": "dependency_graph.enable", + "description": "The dependency graph was enabled for all existing repositories.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1256,19 +1909,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1277,20 +1941,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1298,22 +1972,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1322,22 +2005,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1345,28 +2038,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1375,27 +2074,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -1404,25 +2111,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1431,26 +2146,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1459,21 +2181,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1482,22 +2216,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1506,25 +2250,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1533,22 +2286,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1557,21 +2322,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -1582,21 +2357,32 @@ "description": "A gist was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "gist_id", - "@timestamp", "created_at", "operation_type", - "user_agent", - "actor", - "actor_id", - "visibility", - "action", - "_document_id", - "token_scopes", - "programmatic_access_type" + "visibility" ] }, { @@ -1604,20 +2390,32 @@ "description": "A gist was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "gist_id", - "visibility", - "created_at", + "@timestamp", "_document_id", - "user", - "request_id", - "operation_type", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "@timestamp", - "programmatic_access_type" + "gist_id", + "visibility", + "created_at", + "operation_type" ] }, { @@ -1625,21 +2423,32 @@ "description": "The visibility of a gist was updated.", "docs_reference_links": "N/A", "fields": [ - "action", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", - "user", - "gist_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "visibility", - "user_id", - "created_at", - "_document_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "gist_id", + "visibility", + "created_at" ] }, { @@ -1647,22 +2456,33 @@ "description": "An SSH key was added to a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -1671,23 +2491,34 @@ "description": "An SSH key was removed from a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", "explanation", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -1696,23 +2527,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1720,18 +2560,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1742,20 +2592,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1765,18 +2625,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "created_at", - "user_id", "@timestamp", - "user", - "operation_type", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -1784,18 +2656,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "created_at", - "_document_id", + "user_id", "user_agent", - "@timestamp", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -1803,25 +2687,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -1829,52 +2723,70 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "created_at", - "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" - ] - }, + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", + "created_at", + "oauth_application_id", + "events" + ] + }, { "action": "hook.create", "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -1883,25 +2795,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -1909,26 +2830,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -1936,21 +2866,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -1959,19 +2900,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -1979,21 +2933,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -2002,19 +2967,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -2025,20 +3004,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2048,24 +3039,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ - "user_id", - "repository_selection", - "name", - "user", - "request_id", - "integration", - "operation_type", - "actor_id", - "action", - "repositories_added", - "created_at", - "_document_id", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "repository_selection", + "name", + "integration", + "operation_type", + "repositories_added", + "created_at", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2076,23 +3078,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2103,20 +3117,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2126,19 +3153,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -2147,20 +3188,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -2170,20 +3224,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -2192,20 +3259,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -2214,20 +3294,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -2235,40 +3327,66 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "name", - "integration", - "user", - "user_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", - "application_client_id" - ] - }, - { - "action": "integration.revoke_tokens", - "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", + "operation_type", + "created_at", + "application_client_id" + ] + }, + { + "action": "integration.revoke_tokens", + "description": "Token(s) for a GitHub App were revoked.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2277,17 +3395,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2300,21 +3431,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -2328,17 +3472,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2350,18 +3507,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2369,21 +3538,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -2391,21 +3573,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -2413,22 +3608,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -2436,19 +3644,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -2459,21 +3680,36 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "actor", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", "marketplace_listing", "has_free_trial", - "user_agent", - "request_id", - "actor_id", "yearly_price_in_cents", "description", "bullets", "monthly_price_in_cents", - "marketplace_listing_plan", - "_document_id" + "marketplace_listing_plan" ] }, { @@ -2481,22 +3717,37 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "marketplace_listing_plan", "marketplace_listing", "description", "bullets", "has_free_trial", "created_at", - "actor_id", "operation_type", - "_document_id", - "action", - "user_agent", - "request_id", - "actor", "monthly_price_in_cents", - "yearly_price_in_cents", - "@timestamp" + "yearly_price_in_cents" ] }, { @@ -2504,21 +3755,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor", - "marketplace_listing_plan", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "marketplace_listing_plan", "description", "yearly_price_in_cents", - "@timestamp", "created_at", - "actor_id", "bullets", "has_free_trial", "marketplace_listing", - "user_agent", "monthly_price_in_cents", - "action", "operation_type" ] }, @@ -2527,21 +3793,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "monthly_price_in_cents", - "marketplace_listing", + "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "monthly_price_in_cents", + "marketplace_listing", "description", "bullets", "yearly_price_in_cents", - "request_id", - "actor_id", "has_free_trial", "marketplace_listing_plan", - "user_agent", - "@timestamp", "operation_type", - "actor", "created_at" ] }, @@ -2550,22 +3831,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -2573,22 +3867,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2596,19 +3903,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2616,21 +3935,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2640,16 +3968,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo_id", - "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "public_repo", "created_at", "operation_type" ] @@ -2659,18 +4000,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2680,14 +4034,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -2695,19 +4065,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -2715,18 +4096,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2734,23 +4127,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -2758,20 +4159,30 @@ "description": "An OAuth access token was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", "fields": [ - "_document_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "user", - "user_id", - "created_at", + "_document_id", "action", + "actor", "actor_id", - "request_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" @@ -2782,19 +4193,30 @@ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", "fields": [ "@timestamp", - "user_agent", - "action", - "operation_type", "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_id", + "user_agent", + "operation_type", + "created_at", "explanation", - "hashed_token", - "actor_id", - "token_scopes", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" @@ -2804,19 +4226,30 @@ "description": "An OAuth access token was regenerated.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "_document_id", - "created_at", "@timestamp", - "operation_type", + "_document_id", "action", - "user_agent", - "request_id", "actor", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "oauth_application_name" ] }, @@ -2825,16 +4258,28 @@ "description": "An OAuth access token was revoked.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "request_access_security_header", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -2844,18 +4289,30 @@ "description": "An OAuth access token was updated.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -2863,20 +4320,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2885,20 +4354,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2907,20 +4388,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2929,20 +4422,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2951,19 +4456,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2972,20 +4490,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -2994,20 +4524,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3016,19 +4558,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3037,24 +4592,31 @@ "description": "An authorization for an OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ - "operation_type", - "user_agent", - "user_id", - "actor", - "org_id", + "@timestamp", "_document_id", - "request_id", "action", - "@timestamp", - "created_at", + "actor", "actor_id", - "user", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_is_bot", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -3064,20 +4626,31 @@ "description": "An authorization for an OAuth application was deleted.", "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", "fields": [ - "user_agent", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "actor", "created_at", "explanation", - "user", - "user_id", - "org_id", - "action", - "actor_id", - "token_scopes", "actor_is_bot", "oauth_application_name" ], @@ -3088,20 +4661,31 @@ "description": "An authorization for an OAuth application was updated.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", - "actor_id", "user_agent", - "@timestamp", "operation_type", - "action", - "user", "created_at", - "_document_id", "actor_is_bot", - "request_access_security_header", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -3111,21 +4695,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -3134,24 +4728,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3159,20 +4763,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -3180,22 +4794,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -3203,20 +4825,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -3224,22 +4856,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -3247,21 +4887,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3269,26 +4918,35 @@ "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -3297,26 +4955,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3324,28 +4990,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3353,26 +5027,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3380,20 +5062,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -3402,16 +5095,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -3422,18 +5128,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -3442,18 +5161,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -3462,18 +5193,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -3482,18 +5226,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -3503,20 +5259,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -3524,17 +5291,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -3544,20 +5324,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -3566,20 +5357,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -3588,17 +5393,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3609,20 +5429,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -3631,19 +5465,31 @@ "description": "A new passkey was added.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3651,19 +5497,31 @@ "description": "A new passkey was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3671,35 +5529,61 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" - ] - }, - { - "action": "payment_method.remove", - "description": "A payment method was removed.", - "docs_reference_links": "N/A", - "fields": [ - "user", - "created_at", - "actor_id", - "@timestamp", - "user_id", - "action", - "operation_type", - "actor", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "payment_method.remove", + "description": "A payment method was removed.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", "_document_id", - "request_access_security_header" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3707,18 +5591,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -3726,18 +5622,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3748,18 +5657,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3770,17 +5692,30 @@ "description": "Triggered when you create a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3790,19 +5725,31 @@ "description": "Triggered when you regenerate a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3810,12 +5757,29 @@ "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", "fields": [ - "user_programmatic_access_name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", "operation_type" ], @@ -3826,20 +5790,32 @@ "description": "Triggered when you delete a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "explanation", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3847,17 +5823,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -3868,18 +5857,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -3891,17 +5893,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -3913,17 +5928,30 @@ "description": "A fine-grained personal access token was updated.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3934,15 +5962,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3952,17 +5995,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -3972,15 +6026,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3990,17 +6059,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4010,17 +6090,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4030,17 +6121,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4050,17 +6152,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4070,19 +6183,32 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", - "request_id", - "user_agent", + "action", "actor", - "operation_type" - ], + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "owner", + "operation_type" + ], "docs_reference_titles": "Personalize your profile" }, { @@ -4090,17 +6216,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4108,20 +6247,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -4131,25 +6281,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -4157,20 +6319,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4178,25 +6352,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4204,17 +6390,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -4222,17 +6421,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -4240,18 +6452,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -4260,39 +6484,62 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" - }, - { - "action": "project.link", - "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A", - "fields": [ + "programmatic_access_type", + "repo", "repo_id", - "action", - "actor_id", - "org_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "operation_type", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + }, + { + "action": "project.link", + "description": "A repository was linked to a project board.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", "_document_id", - "created_at", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "repo" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4300,17 +6547,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -4322,22 +6582,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -4345,19 +6614,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -4365,17 +6645,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4383,18 +6676,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -4402,20 +6708,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4423,18 +6739,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -4443,36 +6771,61 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" - }, - { - "action": "project.visibility_private", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + }, + { + "action": "project.visibility_private", "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -4484,21 +6837,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -4506,18 +6871,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4528,23 +6906,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -4553,24 +6942,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -4579,20 +6979,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4601,21 +7015,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -4625,22 +7052,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4649,25 +7088,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", - "actor", - "key", - "fingerprint", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "fingerprint", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4676,23 +7125,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", "key", "fingerprint", - "actor_id", - "actor", "title", - "user_agent", - "user_id", - "request_id", - "read_only", - "token_scopes", - "programmatic_access_type" + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4701,22 +7161,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -4725,21 +7195,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -4748,25 +7227,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -4775,23 +7261,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -4800,24 +7294,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -4826,23 +7327,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -4852,22 +7361,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -4876,19 +7394,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -4897,24 +7428,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -4923,23 +7464,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4950,17 +7500,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -4969,15 +7532,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -4988,16 +7564,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -5007,17 +7596,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -5027,19 +7629,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -5048,17 +7661,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -5067,26 +7693,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -5095,30 +7727,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -5128,20 +7765,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5150,25 +7798,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5177,23 +7833,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -5201,25 +7868,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -5229,23 +7905,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -5253,21 +7939,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -5275,21 +7971,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -5297,22 +8003,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -5320,21 +8035,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -5342,20 +8067,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -5363,22 +8099,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -5386,18 +8131,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5405,22 +8164,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5428,21 +8197,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -5450,18 +8229,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -5470,48 +8261,65 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" - ], - "docs_reference_titles": "Using secrets in GitHub Actions" - }, + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Using secrets in GitHub Actions" + }, { "action": "repo.remove_actions_variable", "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5520,23 +8328,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -5544,26 +8362,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -5572,21 +8395,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -5595,25 +8427,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -5621,22 +8459,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -5645,19 +8493,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -5665,23 +8524,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -5691,20 +8559,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -5715,21 +8594,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -5738,22 +8628,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -5762,21 +8662,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -5785,22 +8696,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -5811,16 +8732,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -5829,22 +8761,31 @@ "description": "Temporary access was enabled for a repository.", "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing user-owned repositories in your enterprise" }, @@ -5854,22 +8795,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -5878,23 +8830,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -5904,41 +8866,61 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" - ] - }, - { - "action": "repo.unarchived", - "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository", - "fields": [ - "actor", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "repo", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", + "visibility" + ] + }, + { + "action": "repo.unarchived", + "description": "A repository was unarchived.", + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -5947,24 +8929,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -5972,25 +8963,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5999,24 +8997,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -6025,25 +9033,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -6052,22 +9068,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -6076,26 +9101,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -6103,31 +9136,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -6136,21 +9176,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -6158,21 +9208,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -6180,21 +9240,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -6202,20 +9273,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -6223,21 +9306,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -6245,19 +9339,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -6265,31 +9372,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -6298,19 +9413,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -6318,8 +9444,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -6328,23 +9453,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -6369,18 +9503,30 @@ "description": "A security key was registered for an account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "created_at", - "user_id", - "action", - "operation_type", - "request_id", "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -6388,18 +9534,30 @@ "description": "A security key was removed from an account.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "operation_type", - "_document_id", - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6407,16 +9565,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6426,18 +9597,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -6446,16 +9630,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6466,15 +9663,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -6484,15 +9694,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -6501,17 +9726,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -6520,17 +9758,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -6539,33 +9791,61 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", - "request_id", - "user_id", - "created_at", - "user", "_document_id", - "user_agent", - "actor", - "operation_type" - ], - "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" - }, - { - "action": "sponsors.sponsor_sponsorship_tier_change", - "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", - "fields": [ - "user_id", + "action", "actor", "actor_id", - "action", - "user", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + }, + { + "action": "sponsors.sponsor_sponsorship_tier_change", + "description": "A sponsorship was upgraded or downgraded.", + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -6575,17 +9855,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -6594,17 +9887,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -6613,18 +9919,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6633,15 +9952,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -6651,16 +9984,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6668,15 +10014,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -6687,16 +10046,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -6706,17 +10078,30 @@ "description": "Triggered when you send an email update to your sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", "fields": [ - "request_id", - "actor", - "action", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" }, @@ -6725,17 +10110,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ - "actor", - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -6746,17 +10144,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -6767,18 +10178,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6788,16 +10210,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6807,17 +10242,30 @@ "description": "You join the waitlist to join GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "actor_id", - "action", "operation_type", - "created_at", - "user", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -6826,16 +10274,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6845,23 +10306,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6869,23 +10340,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6893,23 +10374,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -6917,39 +10408,64 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "actor_is_bot", - "request_access_security_header" - ] - }, + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", + "public_repo", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, { "action": "successor_invitation.accept", "description": "Triggered when you accept a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6958,15 +10474,30 @@ "description": "Triggered when you cancel a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6975,15 +10506,30 @@ "description": "Triggered when you create a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -6992,15 +10538,30 @@ "description": "Triggered when you decline a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7009,15 +10570,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7025,15 +10601,30 @@ "description": "Triggered when you revoke a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7042,17 +10633,30 @@ "description": "A new trusted device was added.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7060,17 +10664,30 @@ "description": "A trusted device was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7078,14 +10695,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "action", - "request_id", - "user_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -7094,29 +10726,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "created_at", - "user_id", - "operation_type", - "user", "_document_id", - "user_agent", - "action" - ] - }, - { - "action": "two_factor_account_recovery.ignore", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "two_factor_account_recovery.ignore", "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "created_at", - "user_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7124,17 +10788,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "operation_type", - "action", - "_document_id" + "created_at", + "operation_type" ] }, { @@ -7142,17 +10819,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user", - "created_at", - "request_id", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -7160,16 +10850,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7177,15 +10881,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_id", - "action", "@timestamp", - "created_at", - "user_agent", - "user", "_document_id", - "request_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7193,18 +10912,30 @@ "description": "A secondary authentication factor was added to a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -7213,18 +10944,30 @@ "description": "Two-factor authentication was disabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", "fields": [ - "actor", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor_id", + "user_agent", "created_at", - "operation_type", - "request_id", - "@timestamp", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Disabling two-factor authentication for your personal account" }, @@ -7233,18 +10976,30 @@ "description": "Two-factor authentication was enabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ - "actor", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Configuring two-factor authentication" }, @@ -7253,52 +11008,92 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user", - "user_id", - "action", "@timestamp", - "request_id", - "_document_id", - "user_agent" - ] - }, - { - "action": "two_factor_authentication.recovery_codes_regenerated", - "description": "Two factor recovery codes were regenerated for a user account.", - "docs_reference_links": "N/A", - "fields": [ - "request_id", - "actor", - "operation_type", "_document_id", - "user_id", "action", - "user", - "user_agent", + "actor", "actor_id", - "@timestamp", - "created_at" - ] + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "two_factor_authentication.recovery_codes_regenerated", + "description": "Two factor recovery codes were regenerated for a user account.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] }, { "action": "two_factor_authentication.remove_factor", "description": "A secondary authentication factor was removed from a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -7307,15 +11102,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "created_at", - "_document_id", - "action", - "@timestamp" + "operation_type", + "created_at" ] }, { @@ -7324,16 +11134,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "operation_type", "user_agent", - "action", - "request_id", - "actor", - "actor_id" + "created_at", + "operation_type" ] }, { @@ -7341,19 +11164,31 @@ "description": "An email address was added to a user account.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", "operation_type", - "_document_id", - "actor_id", - "actor", "email", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding an email address to your GitHub account" }, @@ -7362,18 +11197,30 @@ "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "created_at", - "user", "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -7381,15 +11228,28 @@ "description": "Audit log entries were exported.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "action", - "request_id", - "actor", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", "created_at" ] @@ -7399,20 +11259,31 @@ "description": "A user was blocked by another user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_id", - "_document_id", "actor_id", - "@timestamp", - "user_agent", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -7420,18 +11291,30 @@ "description": "A user changed their password.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "actor_id", - "operation_type", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "created_at", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7439,18 +11322,30 @@ "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -7459,17 +11354,30 @@ "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -7478,19 +11386,31 @@ "description": "A new user account was created.", "docs_reference_links": "N/A", "fields": [ - "email", - "user_id", - "operation_type", "@timestamp", - "request_id", - "user", - "created_at", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "action", - "programmatic_access_type" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "email", + "operation_type", + "created_at" ] }, { @@ -7498,21 +11418,33 @@ "description": "A user secret for Codespaces was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7520,20 +11452,31 @@ "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "user_agent", + "@timestamp", "_document_id", - "operation_type", - "oauth_application_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "@timestamp", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -7541,18 +11484,30 @@ "description": "A user account was destroyed by an asynchronous job.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "request_id", - "user_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7561,19 +11516,30 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "oauth_application_id", + "_document_id", "action", - "user", - "created_at", - "user_agent", - "request_id", "actor", "actor_id", - "operation_type", - "_document_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", + "operation_type" ] }, { @@ -7581,18 +11547,30 @@ "description": "A user deleted his or her account, triggering user.async_delete.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", - "created_at", - "user_agent", "user_id", - "operation_type", - "actor_id", - "action", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7600,18 +11578,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "user_agent", "user_id", - "actor_id", - "action", - "operation_type", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7619,37 +11609,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user_id", - "actor", - "operation_type", - "created_at", - "_document_id", "@timestamp", - "user", - "actor_id", + "_document_id", "action", - "request_access_security_header" - ] - }, - { + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { "action": "user.device_verification_success", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user", "_document_id", "action", - "operation_type", - "user_agent", - "created_at", - "request_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7657,17 +11671,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7675,17 +11702,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7693,17 +11733,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7711,21 +11764,31 @@ "description": "An enterprise managed user claimed an email address.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7733,21 +11796,31 @@ "description": "N/A", "docs_reference_links": "An enterprise managed user unclaimed an email address.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." }, @@ -7756,17 +11829,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7774,17 +11860,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7792,17 +11891,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7810,36 +11922,62 @@ "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "action", - "operation_type", - "request_id", - "created_at", - "_document_id", "@timestamp", - "user", - "org_id", + "_document_id", + "action", "actor", "actor_id", - "user_agent" - ] - }, - { - "action": "user.forgot_password", - "description": "A user requested a password reset.", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "user.forgot_password", + "description": "A user requested a password reset.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", "fields": [ - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "email", - "created_at", - "user_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" }, @@ -7848,17 +11986,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "created_at", - "user_agent", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor", - "operation_type", - "request_id" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7866,18 +12017,30 @@ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -7886,19 +12049,31 @@ "description": "A user signed in.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "actor_id", "@timestamp", - "user", - "action", - "operation_type", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "actor", - "passkey_nickname", - "request_access_security_header" + "passkey_nickname" ] }, { @@ -7906,18 +12081,30 @@ "description": "A user signed out.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7925,18 +12112,30 @@ "description": "A user signed in from a new device.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7944,21 +12143,31 @@ "description": "An ordinary user account was promoted to a site administrator.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", + "user_id", "user_agent", + "created_at", "oauth_application_id", - "request_id", - "operation_type", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7966,16 +12175,29 @@ "description": "A user's account was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user", - "action", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "actor", "operation_type" ] }, @@ -7984,20 +12206,31 @@ "description": "An email address was removed from a user account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "actor", - "actor_id", "created_at", - "email", - "token_scopes", - "programmatic_access_type" + "email" ] }, { @@ -8005,20 +12238,32 @@ "description": "A user secret for Codespaces was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "key", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "key", + "integration", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8026,20 +12271,31 @@ "description": "A username was changed.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "request_id", - "actor_id", - "old_login", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "operation_type", "user_agent", - "token_scopes", - "programmatic_access_type" + "old_login", + "created_at", + "operation_type" ] }, { @@ -8047,18 +12303,30 @@ "description": "A user reset their account password.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "@timestamp", - "_document_id", - "actor", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8066,16 +12334,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_id", - "action", "@timestamp", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -8086,16 +12367,28 @@ "fields": [ "@timestamp", "_document_id", - "request_id", - "user_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor_id", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -8104,18 +12397,30 @@ "description": "A user signed in from an unrecognized device.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "created_at", - "actor", - "actor_id", - "@timestamp", - "request_access_security_header" + "created_at" ] }, { @@ -8123,18 +12428,30 @@ "description": "A user signed in from an unrecognized device and location.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "created_at", - "_document_id", - "request_id", - "action", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8142,22 +12459,33 @@ "description": "Triggered when you clear the status on your profile.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "message", - "user", - "actor_id", "created_at", - "request_id", "limited_availability", - "action", "emoji", - "operation_type", - "user_agent", - "@timestamp", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -8165,23 +12493,33 @@ "description": "Triggered when you set or change the status on your profile.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", "fields": [ - "limited_availability", - "user", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "message", - "user_id", - "created_at", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "limited_availability", + "message", + "created_at", "emoji", - "org", - "actor", - "operation_type", - "token_scopes", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Personalize your profile" }, @@ -8190,21 +12528,31 @@ "description": "A user account was suspended.", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", - "operation_type", - "actor_id", - "user", - "user_agent", - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", - "user_id", + "_document_id", "action", - "token_scopes", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -8212,18 +12560,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", - "actor_id", "@timestamp", - "operation_type", "_document_id", - "user_agent", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8231,18 +12591,30 @@ "description": "A 2FA challenge issued for a user account failed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "_document_id", - "user_agent", - "user", - "actor_id", - "actor", - "user_id", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8252,16 +12624,28 @@ "fields": [ "@timestamp", "_document_id", - "user_id", - "operation_type", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "actor", + "user_id", "user_agent", - "request_id", - "action", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8269,18 +12653,30 @@ "description": "A user used their 2FA recovery codes.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "user_agent", - "request_id", - "user", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "created_at", - "@timestamp", - "_document_id", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8288,18 +12684,30 @@ "description": "A user downloaded 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8307,17 +12715,30 @@ "description": "A user printed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", - "user_agent", - "request_id", - "user_id", - "created_at", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8325,18 +12746,30 @@ "description": "A user viewed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", "created_at", - "user", - "operation_type", - "@timestamp", - "request_id", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -8344,17 +12777,30 @@ "description": "A user was prompted for a two-factor authentication code.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", "fields": [ - "user", - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "actor" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" }, @@ -8363,19 +12809,31 @@ "description": "A user was unblocked by another user.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "actor", - "@timestamp", - "user_agent", - "user_id", - "user", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -8383,21 +12841,31 @@ "description": "A user account was unsuspended.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", - "user", "action", - "user_agent", "actor", - "oauth_application_id", - "operation_type", "actor_id", - "created_at", - "@timestamp", - "user_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -8405,21 +12873,33 @@ "description": "A user secret for Codespaces was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8427,46 +12907,64 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", + "operation_type" + ] + }, + { + "action": "workflows.approve_workflow_job", + "description": "A workflow job was approved.", + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" - ] - }, - { - "action": "workflows.approve_workflow_job", - "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", - "fields": [ "user_agent", - "request_id", - "actor", - "actor_id", "workflow_run_id", "run_number", - "user", - "user_id", - "repo", - "repo_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -8475,23 +12973,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8499,23 +13007,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8525,23 +13041,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -8550,22 +13078,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8573,21 +13112,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -8595,25 +13145,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8621,24 +13179,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -8647,25 +13214,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.19/enterprise.json b/src/audit-logs/data/ghes-3.19/enterprise.json index a25304cad3e2..956618cc9302 100644 --- a/src/audit-logs/data/ghes-3.19/enterprise.json +++ b/src/audit-logs/data/ghes-3.19/enterprise.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,17 +67,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "request_id", "@timestamp", - "user_agent", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", - "user_id", + "token_scopes", "user", - "actor", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -61,18 +98,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", + "token_scopes", "user", - "request_id", - "_document_id", - "user_agent", - "actor", "user_id", - "actor_id", - "operation_type", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -80,18 +129,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "actor_id", - "operation_type", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "token_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -99,29 +160,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -129,31 +196,34 @@ "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests", "fields": [ - "user_agent", - "request_id", - "request_method", - "query_string", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", - "request_body", - "status_code", - "url_path", "business", "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "request_method", + "query_string", + "request_body", + "status_code", + "url_path", + "public_repo", "created_at", "operation_type", "route", @@ -167,18 +237,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -186,20 +268,32 @@ "description": "A manual check of the endpoint configured for audit log streaming was performed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "audit_log_stream_result", - "business_id", "business", - "action", - "_document_id", - "@timestamp", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_result", "created_at", "operation_type", - "audit_log_stream_sink_details", - "request_access_security_header" + "audit_log_stream_sink_details" ] }, { @@ -207,18 +301,31 @@ "description": "An endpoint was added for audit log streaming.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "business_id", "business", - "audit_log_stream_sink", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_sink", + "created_at", + "operation_type", "audit_log_stream_id" ] }, @@ -227,15 +334,28 @@ "description": "An audit log streaming endpoint was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "business_id", "business", - "action", - "_document_id", - "@timestamp", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "audit_log_stream_id", @@ -247,17 +367,30 @@ "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "audit_log_stream_enabled", - "business_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_enabled", "audit_log_stream_sink", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "new_s3_bucket", @@ -280,21 +413,34 @@ "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -310,22 +456,34 @@ "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "uuid", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -333,25 +491,37 @@ "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", - "request_access_security_header", "old_target_amount", "old_budget_limit_type", "old_alert_enabled", @@ -365,17 +535,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -384,19 +567,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -405,15 +600,28 @@ "description": "Azure subscription has been linked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -423,15 +631,28 @@ "description": "Azure subscription has been unlinked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -441,18 +662,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", - "user", - "user_id", - "user_agent", - "created_at", - "action" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -460,18 +694,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -479,15 +725,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -497,22 +756,31 @@ "description": "An enterprise owner was added to an enterprise.", "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", "fields": [ - "name", - "business", - "user", - "user_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "request_id", + "business", "business_id", - "_document_id", - "user_agent", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "operation_type" ], "docs_reference_titles": "Inviting people to manage your enterprise" }, @@ -521,22 +789,32 @@ "description": "An organization was added to an enterprise.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "operation_type", "name", "created_at", - "request_id", - "_document_id", - "business", - "organization_upgrade", - "request_access_security_header" + "organization_upgrade" ] }, { @@ -544,20 +822,30 @@ "description": "GitHub Advanced Security was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -566,17 +854,28 @@ "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -587,21 +886,31 @@ "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -610,17 +919,28 @@ "description": "GitHub Advanced Security was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -631,17 +951,28 @@ "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -652,21 +983,31 @@ "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -675,20 +1016,32 @@ "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "new_policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "new_policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -697,20 +1050,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -718,17 +1083,28 @@ "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -740,21 +1116,31 @@ "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -763,18 +1149,31 @@ "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -783,17 +1182,30 @@ "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", "fields": [ - "name", - "operation_type", - "business_id", - "user_agent", - "actor_id", - "request_id", - "actor", + "@timestamp", "_document_id", - "business", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -803,19 +1215,32 @@ "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", "business_id", - "action", - "_document_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "business", "visibility", "created_at", - "actor", - "operation_type", - "@timestamp" + "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -824,21 +1249,33 @@ "description": "The policy for Code scanning autofix was updated for an enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -846,21 +1283,33 @@ "description": "The policy for Code scanning autofix third party tools was updated for an enterprise.", "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/getting-started/github-security-features#available-with-github-code-security" }, @@ -869,18 +1318,30 @@ "description": "The policy for Code Security enablement was updated for an enterprise.", "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -892,19 +1353,31 @@ "description": "An enterprise was created.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", "_document_id", "action", - "@timestamp", - "request_id", - "name", + "actor", + "actor_id", "business", "business_id", - "operation_type", - "actor", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "name", + "operation_type", + "created_at" ] }, { @@ -912,17 +1385,28 @@ "description": "Dependabot alerts were disabled for new repositories in your enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -932,17 +1416,28 @@ "description": "Dependabot alerts were enabled for new repositories in your enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -952,17 +1447,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -972,18 +1480,30 @@ "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -991,17 +1511,28 @@ "description": "Display of IP addresses within audit log events for the enterprise was disabled.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1012,18 +1543,31 @@ "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.", "docs_reference_links": "N/A", "fields": [ - "action", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "business_id", - "actor_id", - "name", - "_document_id", - "request_id" + "name" ] }, { @@ -1031,15 +1575,28 @@ "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1049,17 +1606,28 @@ "description": "Display of IP addresses within audit log events for the enterprise was enabled.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1070,18 +1638,31 @@ "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "operation_type", - "created_at", + "actor_id", "business", "business_id", - "name", - "_document_id", - "request_id", - "@timestamp" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "name" ] }, { @@ -1089,20 +1670,31 @@ "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", "actor_id", - "@timestamp", - "request_id", "business", - "name", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "business_id", - "_document_id" + "created_at", + "name", + "operation_type" ] }, { @@ -1110,20 +1702,31 @@ "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1131,20 +1734,31 @@ "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "name", - "actor", - "operation_type", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "business", - "actor_id", - "created_at", - "action", + "user_id", "user_agent", - "request_id", - "user_id" + "name", + "operation_type", + "created_at" ] }, { @@ -1152,20 +1766,31 @@ "description": "An enterprise owner was removed from an enterprise.", "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", - "user_agent", + "actor_id", "business", "business_id", - "@timestamp", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "name", - "actor_id", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", - "user" + "user_agent", + "operation_type", + "created_at", + "name" ], "docs_reference_titles": "Inviting people to manage your enterprise" }, @@ -1174,20 +1799,31 @@ "description": "An organization was removed from an enterprise.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "business", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "business_id", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "name", - "org" + "name" ] }, { @@ -1195,18 +1831,31 @@ "description": "The slug for the enterprise URL was renamed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "name", - "business_id", - "user_agent", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", - "@timestamp", - "created_at", + "actor_id", "business", - "_document_id" + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ] }, { @@ -1214,20 +1863,31 @@ "description": "The SAML single sign-on session for a member in an enterprise was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", - "user_agent", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "actor", - "_document_id", - "actor_id", "name", - "@timestamp", - "user_id", - "action", - "created_at", - "business" + "created_at" ] }, { @@ -1235,17 +1895,28 @@ "description": "Automatic partner validation checks have been disabled at the business level", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1256,17 +1927,28 @@ "description": "Automatic partner validation checks have been enabled at the business level", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1277,20 +1959,30 @@ "description": "An enterprise-level custom pattern was created for secret scanning.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ - "user_agent", - "request_id", - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -1299,17 +1991,28 @@ "description": "An enterprise-level custom pattern was removed from secret scanning.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1319,20 +2022,30 @@ "description": "An enterprise-level custom pattern was published for secret scanning.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1340,17 +2053,28 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1361,20 +2085,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -1383,17 +2117,28 @@ "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1403,17 +2148,28 @@ "description": "Secret scanning was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1424,17 +2180,28 @@ "description": "Secret scanning was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1445,17 +2212,28 @@ "description": "Secret scanning was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1466,17 +2244,28 @@ "description": "Secret scanning was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1487,39 +2276,61 @@ "description": "Secret scanning for non-provider patterns was disabled at the enterprise level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Supported secret scanning patterns" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" + ], + "docs_reference_titles": "Supported secret scanning patterns" }, { "action": "business_secret_scanning_non_provider_patterns.enabled", "description": "Secret scanning for non-provider patterns was enabled at the enterprise level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1531,17 +2342,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1552,17 +2374,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1573,17 +2406,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1594,17 +2438,28 @@ "description": "Push protection for secret scanning was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1615,17 +2470,28 @@ "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1636,17 +2502,28 @@ "description": "Push protection for secret scanning was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1657,17 +2534,28 @@ "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1678,10 +2566,28 @@ "description": "The push protection setting was updated for a secret type for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "push_protection_setting", "secret_type", "secret_type_display_name", @@ -1694,10 +2600,28 @@ "description": "The push protection pattern configuration was updated for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" @@ -1707,20 +2631,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "new_policy", "business", "business_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "new_policy", + "created_at", + "operation_type" ] }, { @@ -1728,26 +2664,36 @@ "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1755,24 +2701,34 @@ "description": "A CSV export was requested on the \"Coverage\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1780,26 +2736,36 @@ "description": "A CSV export was requested on the \"Overview Dashboard\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1807,20 +2773,31 @@ "description": "A CSV export was requested on the \"Risk\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1831,17 +2808,29 @@ "description": "The cache retention policy for GitHub Actions was set for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type", "actor_is_bot" @@ -1853,17 +2842,29 @@ "description": "The cache storage policy for GitHub Actions was set for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type", "actor_is_bot" @@ -1875,17 +2876,30 @@ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "created_at", "operation_type" ], @@ -1896,20 +2910,32 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1918,19 +2944,32 @@ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "limit", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1939,41 +2978,65 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "operation_type" + ], + "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, { "action": "business.set_fork_pr_workflows_policy", "description": "The policy for fork pull request workflows was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1982,19 +3045,31 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -2003,20 +3078,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "issuer", - "name", - "user_agent", - "action", "@timestamp", "_document_id", + "action", "actor", + "actor_id", "business", "business_id", - "actor_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "issuer", + "name", + "created_at", + "operation_type" ] }, { @@ -2024,18 +3111,31 @@ "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "updated_github_owned_allowed", "updated_verified_allowed", "updated_patterns", @@ -2050,20 +3150,33 @@ "description": "The base repository permission setting was updated for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", "fields": [ - "business_id", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "permission", - "action", "created_at", - "@timestamp", - "request_id", "name", - "_document_id", - "old_permission", - "business" + "old_permission" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -2072,19 +3185,32 @@ "description": "The repository creation setting was updated for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation", "fields": [ - "created_at", + "@timestamp", "_document_id", - "request_id", - "name", - "business_id", + "action", "actor", "actor_id", - "@timestamp", - "operation_type", - "permission", - "action", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "name", + "operation_type", + "permission", "visibility" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -2094,19 +3220,32 @@ "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories", "fields": [ - "business_id", - "created_at", - "action", - "operation_type", "@timestamp", - "request_id", - "permission", + "_document_id", + "action", "actor", "actor_id", - "name", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "business" + "created_at", + "operation_type", + "permission", + "name" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -2115,20 +3254,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -2137,20 +3287,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", - "user", - "user_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -2161,17 +3322,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2179,15 +3352,31 @@ "description": "Existing code scanning alerts appeared in a branch.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2197,15 +3386,31 @@ "description": "Code scanning alerts were fixed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2215,15 +3420,31 @@ "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_numbers", "commit_oid", - "ref", - "request_id", - "org_id", - "org", - "business_id", - "business" + "ref" ], "docs_reference_titles": "About code scanning" }, @@ -2232,15 +3453,29 @@ "description": "Code scanning alerts were manually dismissed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers", "dismissal_approver_id" ], @@ -2251,19 +3486,31 @@ "description": "Dismissal of code scanning alerts was approved.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2274,19 +3521,31 @@ "description": "Dismissal of code scanning alerts was denied.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2297,19 +3556,31 @@ "description": "Dismissal of code scanning alerts was requested.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2320,13 +3591,31 @@ "description": "Code scanning alerts were seen for the first time.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2336,15 +3625,31 @@ "description": "Code scanning alerts that were previously fixed reappeared.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "commit_oid", - "ref", - "request_id", - "org_id", - "org", - "business_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", + "commit_oid", + "ref", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2354,15 +3659,29 @@ "description": "Code scanning alerts that were previously dismissed were reopened.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2372,14 +3691,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2389,25 +3723,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -2418,22 +3761,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -2445,22 +3799,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -2469,15 +3834,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -2488,17 +3868,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2508,27 +3901,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "org", "owner", "pull_request_id", "machine_type", - "user_id", - "user", "devcontainer_path", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2536,19 +3938,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "owner", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", + "operation_type", + "created_at", + "public_repo" ] }, { @@ -2556,18 +3971,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -2576,23 +4003,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2600,16 +4034,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -2618,24 +4066,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2643,15 +4097,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -2661,20 +4128,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2682,19 +4159,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -2702,21 +4191,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -2724,22 +4222,33 @@ "description": "Specific repositories were disabled from using Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "owner_type", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -2747,21 +4256,31 @@ "description": "Specific repositories were enabled to use Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "owner_type", - "owner", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2771,20 +4290,32 @@ "description": "Copilot coding agent access was updated for the organization's or user's repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_access", "old_access", - "org_id", "owner_type", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2794,21 +4325,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2818,19 +4358,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -2840,21 +4389,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2864,18 +4422,31 @@ "description": "A new custom property definition was created.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -2888,18 +4459,31 @@ "description": "A custom property definition was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -2913,14 +4497,29 @@ "description": "A custom property definition was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "value_type", @@ -2933,8 +4532,7 @@ "old_default_value", "old_value_type", "old_values_editable_by", - "values_editable_by", - "request_access_security_header" + "values_editable_by" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2943,27 +4541,35 @@ "description": "A repository's custom property value was manually set for the first time.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2972,19 +4578,31 @@ "description": "A repository's custom property value was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ - "actor", - "actor_id", - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2993,16 +4611,29 @@ "description": "A repository's custom property value was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "definition_id" @@ -3014,19 +4645,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -3035,19 +4677,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -3056,19 +4709,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -3077,19 +4741,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -3098,21 +4773,31 @@ "description": "The default repository access for Dependabot was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "access_level", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -3121,17 +4806,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -3139,19 +4837,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -3160,39 +4869,61 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" - ] - }, - { - "action": "dependabot_security_updates_new_repos.disable", - "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", - "fields": [ - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "created_at", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "dependabot_security_updates_new_repos.disable", + "description": " Dependabot security updates were disabled for all new repositories.", + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -3201,19 +4932,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -3221,19 +4963,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -3242,19 +4995,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3262,19 +5026,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -3283,20 +5058,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3304,21 +5089,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "team", - "created_at", - "user_id", "@timestamp", - "number", - "org", - "title", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", "user_agent", - "operation_type", - "_document_id" + "team", + "created_at", + "number", + "title", + "operation_type" ] }, { @@ -3326,18 +5123,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user_id", - "actor", "number", - "user", - "created_at", - "request_id", - "_document_id" + "created_at" ] }, { @@ -3345,18 +5155,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "action", - "_document_id", - "request_id", - "org", "@timestamp", - "actor_id", - "operation_type", - "user", - "user_id", - "org_id", - "user_agent", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "number", "team", "created_at" @@ -3367,21 +5188,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "_document_id", - "title", - "user", - "user_agent", - "org", - "operation_type", - "actor_id", "@timestamp", - "actor", - "team", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", + "title", + "operation_type", + "team", "number" ] }, @@ -3390,17 +5222,31 @@ "description": "A global announcement banner was created for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3411,16 +5257,30 @@ "description": "A global announcement banner was removed from the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3431,18 +5291,32 @@ "description": "A global announcement banner was updated for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", "old_message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3453,23 +5327,31 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise" }, @@ -3478,19 +5360,33 @@ "description": "A domain was approved for an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3499,18 +5395,33 @@ "description": "A domain was added to an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3519,18 +5430,33 @@ "description": "A domain was removed from an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3539,18 +5465,33 @@ "description": "A domain was verified for an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3559,18 +5500,30 @@ "description": "A new GitHub Actions self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -3579,20 +5532,30 @@ "description": "A GitHub Actions self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -3601,20 +5564,30 @@ "description": "An enterprise role was assigned to a user or enterprise team.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "enterprise_role_id", - "enterprise_role_name", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "enterprise_role_id", + "enterprise_role_name", "created_at", "operation_type", "actor_is_bot" @@ -3626,20 +5599,32 @@ "description": "A custom enterprise role was created in an enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3651,20 +5636,32 @@ "description": "A custom enterprise role was deleted in an enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3676,20 +5673,30 @@ "description": "A user or enterprise team was unassigned an enterprise role.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "enterprise_role_id", - "enterprise_role_name", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "enterprise_role_id", + "enterprise_role_name", "created_at", "operation_type", "actor_is_bot" @@ -3701,21 +5708,33 @@ "description": "A custom enterprise role was edited in an enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", "old_role_permissions", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3727,18 +5746,31 @@ "description": "A GitHub Actions self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows" ], "docs_reference_titles": "Removing self-hosted runners" @@ -3748,18 +5780,31 @@ "description": "A GitHub Actions self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3768,41 +5813,66 @@ "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", - "runner_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ], - "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" - }, - { - "action": "enterprise.runner_group_runners_added", - "description": "A GitHub Actions self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", - "fields": [ - "user_agent", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", + "runner_id", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + }, + { + "action": "enterprise.runner_group_runners_added", + "description": "A GitHub Actions self-hosted runner was added to a group.", + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3811,19 +5881,32 @@ "description": "A GitHub Actions runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -3832,24 +5915,36 @@ "description": "The configuration of a GitHub Actions self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3858,14 +5953,32 @@ "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -3874,14 +5987,32 @@ "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -3890,18 +6021,36 @@ "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", "target_version", "runner_group_id", "runner_group_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Self-hosted runners" }, @@ -3910,22 +6059,32 @@ "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "business_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "user", - "business", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3933,21 +6092,33 @@ "description": "A license for GitHub Copilot was assigned to an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3955,38 +6126,64 @@ "description": "A license for GitHub Copilot was unassigned from an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "business_id", - "enterprise_team_id", - "enterprise_team", "business", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "enterprise_team.create", - "description": "A new enterprise team was created.", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "enterprise_team_id", + "enterprise_team", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, + { + "action": "enterprise_team.create", + "description": "A new enterprise team was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3996,17 +6193,30 @@ "description": "An enterprise team was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -4017,22 +6227,32 @@ "description": "A member was removed from the enterprise team or an IdP group linked to an enterprise team, or an IdP group was unlinked from an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "business_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "user", - "business", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4040,18 +6260,31 @@ "description": "The name of an enterprise team was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "business_id", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -4062,22 +6295,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -4086,22 +6328,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4109,28 +6361,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -4139,27 +6397,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -4168,25 +6434,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -4195,26 +6469,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -4223,21 +6504,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -4246,22 +6539,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -4270,25 +6573,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -4297,22 +6609,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -4321,21 +6645,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -4346,27 +6680,33 @@ "description": "A user was added to an external group.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "external_group", - "external_group_id", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "external_group", + "external_group_id", "created_at", "operation_type", - "business", - "business_id", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -4374,43 +6714,66 @@ "description": "An external group was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", - "scim_group_id" - ] - }, - { - "action": "external_group.link", - "description": "An external group was linked to a GitHub team.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "external_group_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", + "scim_group_id" + ] + }, + { + "action": "external_group.link", + "description": "An external group was linked to a GitHub team.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "external_group", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "scim_group_id", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "external_group_id", + "operation_type", + "created_at", + "external_group", + "scim_group_id" ] }, { @@ -4418,21 +6781,31 @@ "description": "An external group was created.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -4440,26 +6813,32 @@ "description": "A user was removed from an external group.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "external_group", - "external_group_id", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "external_group", + "external_group_id", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -4467,15 +6846,29 @@ "description": "Failed external group SCIM API request.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", @@ -4483,15 +6876,9 @@ "url_path", "scim_group_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4500,30 +6887,38 @@ "description": "Successful external group SCIM API request. Excludes GET API requests.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", "status_code", "url_path", "scim_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4532,18 +6927,31 @@ "description": "An external group was unlinked to a GitHub team.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "external_group" ] }, @@ -4552,22 +6960,32 @@ "description": "An external group was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "scim_group_id", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at", + "scim_group_id" ] }, { @@ -4575,25 +6993,33 @@ "description": "An external group's display name was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", "external_group", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -4601,20 +7027,31 @@ "description": "An external identity was deprovisioned, suspending the linked GitHub user.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -4622,17 +7059,31 @@ "description": "An external identity was created and linked to a GitHub user.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "scim_user_id", - "request_access_security_header" + "scim_user_id" ] }, { @@ -4640,15 +7091,29 @@ "description": "Failed external identity SCIM API request.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", @@ -4656,15 +7121,9 @@ "url_path", "scim_user_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4673,30 +7132,38 @@ "description": "Successful external identity SCIM API request. Excludes GET API requests.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", "status_code", "url_path", "scim_user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4705,18 +7172,31 @@ "description": "An external identity was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "scim_user_id", - "request_access_security_header" + "scim_user_id" ] }, { @@ -4724,21 +7204,32 @@ "description": "A gist was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "gist_id", - "@timestamp", "created_at", "operation_type", - "user_agent", - "actor", - "actor_id", - "visibility", - "action", - "_document_id", - "token_scopes", - "programmatic_access_type" + "visibility" ] }, { @@ -4746,20 +7237,32 @@ "description": "A gist was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "gist_id", - "visibility", - "created_at", + "@timestamp", "_document_id", - "user", - "request_id", - "operation_type", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "@timestamp", - "programmatic_access_type" + "gist_id", + "visibility", + "created_at", + "operation_type" ] }, { @@ -4767,21 +7270,32 @@ "description": "The visibility of a gist was updated.", "docs_reference_links": "N/A", "fields": [ - "action", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", - "user", - "gist_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "visibility", - "user_id", - "created_at", - "_document_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "gist_id", + "visibility", + "created_at" ] }, { @@ -4789,20 +7303,31 @@ "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "user", - "user_id", - "transport_protocol_name" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "transport_protocol", + "repository_public", + "transport_protocol_name" ] }, { @@ -4810,20 +7335,30 @@ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4832,19 +7367,30 @@ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4853,22 +7399,33 @@ "description": "An SSH key was added to a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -4877,23 +7434,34 @@ "description": "An SSH key was removed from a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", "explanation", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -4902,23 +7470,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4926,18 +7503,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -4948,20 +7535,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -4971,18 +7568,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "created_at", - "user_id", "@timestamp", - "user", - "operation_type", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -4990,18 +7599,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "created_at", - "_document_id", + "user_id", "user_agent", - "@timestamp", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -5009,25 +7630,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -5035,25 +7666,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -5061,26 +7701,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -5089,25 +7738,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -5115,26 +7773,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -5142,21 +7809,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -5165,19 +7843,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -5185,21 +7876,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -5208,43 +7910,69 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", - "request_id", - "repository_selection", - "user_id", - "action", - "user_agent", - "user", - "created_at", - "integration", "_document_id", - "programmatic_access_type", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" - }, + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "repository_selection", + "created_at", + "integration", + "application_client_id" + ], + "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" + }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -5254,24 +7982,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -5282,23 +8021,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -5309,21 +8060,33 @@ "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", "operation_type", - "@timestamp", "integration", - "action", - "user_agent", "reason", - "_document_id", - "org", - "org_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -5334,20 +8097,32 @@ "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ "@timestamp", - "actor_id", - "org", "_document_id", - "requester", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "requester", "created_at", "url", - "org_id", - "request_id", "operation_type", - "actor", "integration", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -5357,20 +8132,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -5380,19 +8168,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -5401,20 +8203,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -5424,20 +8239,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -5446,20 +8274,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -5468,20 +8309,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -5489,19 +8342,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -5510,19 +8376,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -5531,17 +8410,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -5554,21 +8446,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -5582,17 +8487,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -5604,19 +8522,30 @@ "description": "An IP allow list was disabled.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "actor", - "request_id", - "org", - "user_agent", + "@timestamp", "_document_id", - "user_id", + "action", + "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "@timestamp", - "user" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5624,19 +8553,30 @@ "description": "An IP allow list was disabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5644,17 +8584,28 @@ "description": "IP allow list user level enforcement was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5664,20 +8615,29 @@ "description": "An IP allow list was enabled.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "user_id", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "business_id", - "_document_id", - "action", - "@timestamp", + "user_id", "user_agent", - "actor_id", "operation_type", - "org", "created_at" ] }, @@ -5686,19 +8646,30 @@ "description": "An IP allow list was enabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5706,17 +8677,28 @@ "description": "IP allow list user level enforcement was enabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5726,24 +8708,32 @@ "description": "An IP address was added to an IP allow list.", "docs_reference_links": "N/A", "fields": [ - "active", - "org", - "ip_allow_list_entry", "@timestamp", "_document_id", - "operation_type", - "created_at", - "user_agent", "action", - "request_id", + "actor", "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "business", - "actor", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", + "ip_allow_list_entry", + "operation_type", + "created_at" ] }, { @@ -5751,24 +8741,32 @@ "description": "An IP address was deleted from an IP allow list.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "ip_allow_list_entry", - "org", - "operation_type", - "created_at", - "active", "action", - "@timestamp", + "actor", + "actor_id", "business", "business_id", - "user_agent", + "hashed_token", + "org", "org_id", - "actor", - "actor_id", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ip_allow_list_entry", + "operation_type", + "created_at", + "active" ] }, { @@ -5776,19 +8774,32 @@ "description": "An IP address or its description was changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "actor_id", "ip_allow_list_entry", - "active", - "org_id", - "@timestamp" + "active" ] }, { @@ -5796,20 +8807,30 @@ "description": "An issue was marked as blocked by another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -5820,19 +8841,30 @@ "description": "The blocked by relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", - "action", - "_document_id", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", + "public_repo", "created_at", "operation_type" ] @@ -5842,20 +8874,30 @@ "description": "An issue was marked as blocking another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -5866,20 +8908,30 @@ "description": "The blocking relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -5890,18 +8942,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5909,21 +8973,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -5931,21 +9008,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -5953,22 +9043,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -5976,19 +9079,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -5999,21 +9115,36 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "actor", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", "marketplace_listing", "has_free_trial", - "user_agent", - "request_id", - "actor_id", "yearly_price_in_cents", "description", "bullets", "monthly_price_in_cents", - "marketplace_listing_plan", - "_document_id" + "marketplace_listing_plan" ] }, { @@ -6021,44 +9152,74 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "marketplace_listing_plan", - "marketplace_listing", - "description", - "bullets", - "has_free_trial", - "created_at", - "actor_id", - "operation_type", + "@timestamp", "_document_id", "action", - "user_agent", - "request_id", - "actor", - "monthly_price_in_cents", - "yearly_price_in_cents", - "@timestamp" - ] - }, - { - "action": "marketplace_listing_plan.retire", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "marketplace_listing_plan", + "marketplace_listing", + "description", + "bullets", + "has_free_trial", + "created_at", + "operation_type", + "monthly_price_in_cents", + "yearly_price_in_cents" + ] + }, + { + "action": "marketplace_listing_plan.retire", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "marketplace_listing_plan", "description", "yearly_price_in_cents", - "@timestamp", "created_at", - "actor_id", "bullets", "has_free_trial", "marketplace_listing", - "user_agent", "monthly_price_in_cents", - "action", "operation_type" ] }, @@ -6067,21 +9228,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "monthly_price_in_cents", - "marketplace_listing", + "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "monthly_price_in_cents", + "marketplace_listing", "description", "bullets", "yearly_price_in_cents", - "request_id", - "actor_id", "has_free_trial", "marketplace_listing_plan", - "user_agent", - "@timestamp", "operation_type", - "actor", "created_at" ] }, @@ -6090,22 +9266,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -6113,22 +9302,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6136,19 +9338,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -6156,21 +9370,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6180,16 +9403,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6199,18 +9435,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6220,34 +9469,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", - "operation_type", - "created_at", - "request_access_security_header" - ] + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -6255,18 +9531,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6274,23 +9562,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -6298,20 +9594,30 @@ "description": "An OAuth access token was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", "fields": [ - "_document_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "user", - "user_id", - "created_at", + "_document_id", "action", + "actor", "actor_id", - "request_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" @@ -6322,19 +9628,30 @@ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", "fields": [ "@timestamp", - "user_agent", - "action", - "operation_type", "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_id", + "user_agent", + "operation_type", + "created_at", "explanation", - "hashed_token", - "actor_id", - "token_scopes", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" @@ -6344,19 +9661,30 @@ "description": "An OAuth access token was regenerated.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "_document_id", - "created_at", "@timestamp", - "operation_type", + "_document_id", "action", - "user_agent", - "request_id", "actor", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "oauth_application_name" ] }, @@ -6365,16 +9693,28 @@ "description": "An OAuth access token was revoked.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "request_access_security_header", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -6384,18 +9724,30 @@ "description": "An OAuth access token was updated.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -6403,42 +9755,66 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "org", - "created_at", - "oauth_application_id", - "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", "@timestamp", "_document_id", - "request_id", - "request_access_security_header" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.destroy", - "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user_id", "operation_type", + "oauth_application" + ], + "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + }, + { + "action": "oauth_application.destroy", + "description": "An OAuth application was deleted.", + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6447,20 +9823,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6469,20 +9857,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6491,19 +9891,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6512,20 +9925,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6534,20 +9959,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6557,18 +9994,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user_agent", - "org_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "oauth_application_id", - "action", "created_at", - "actor", - "actor_id", - "oauth_application", - "_document_id", - "request_id" + "oauth_application" ] }, { @@ -6576,19 +10026,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6597,15 +10060,32 @@ "description": "An OAuth application was unsuspended for a user or organization account.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "operation_type", - "org_id", + "@timestamp", + "_document_id", "action", - "oauth_application_id", - "oauth_application", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "@timestamp", - "_document_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "oauth_application_id", + "oauth_application", + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6614,24 +10094,31 @@ "description": "An authorization for an OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ - "operation_type", - "user_agent", - "user_id", - "actor", - "org_id", + "@timestamp", "_document_id", - "request_id", "action", - "@timestamp", - "created_at", + "actor", "actor_id", - "user", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_is_bot", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -6641,20 +10128,31 @@ "description": "An authorization for an OAuth application was deleted.", "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", "fields": [ - "user_agent", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "actor", "created_at", "explanation", - "user", - "user_id", - "org_id", - "action", - "actor_id", - "token_scopes", "actor_is_bot", "oauth_application_name" ], @@ -6665,20 +10163,31 @@ "description": "An authorization for an OAuth application was updated.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", - "actor_id", "user_agent", - "@timestamp", "operation_type", - "action", - "user", "created_at", - "_document_id", "actor_is_bot", - "request_access_security_header", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -6688,17 +10197,28 @@ "description": "An invitation sent to an organization to join an enterprise was accepted.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6709,20 +10229,30 @@ "description": "A billing manager was added to an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "org", - "user_id", "action", - "created_at", - "org_id", - "user", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" }, @@ -6731,21 +10261,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -6754,24 +10294,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -6779,21 +10329,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -6801,43 +10361,61 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes" - ] + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -6845,20 +10423,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -6866,22 +10454,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -6889,21 +10485,31 @@ "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "new_policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "new_policy", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -6913,19 +10519,30 @@ "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -6934,19 +10551,30 @@ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -6956,16 +10584,29 @@ "description": "A user initiated a background job to delete an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "@timestamp", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "created_at" ] }, @@ -6974,16 +10615,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_agent", - "action", "@timestamp", - "actor_id", - "org_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -6992,18 +10646,31 @@ "description": "An organization owner blocked a user from accessing the organization's repositories.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", "fields": [ - "actor", - "user_agent", - "org_id", - "created_at", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "blocked_user", + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" }, @@ -7012,19 +10679,30 @@ "description": "An invitation for an organization to join an enterprise was revoked", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "initiated_from" ], "docs_reference_titles": "Adding organizations to your enterprise" @@ -7034,22 +10712,33 @@ "description": "An invitation sent to a user to join an organization was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "email", - "@timestamp", - "actor", - "action", "operation_type", - "user_agent", - "org", "invitation_id", - "_document_id", "created_at", - "invitee_email", - "token_scopes", - "programmatic_access_type" + "invitee_email" ] }, { @@ -7057,19 +10746,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -7077,23 +10777,31 @@ "description": "Autofix for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7101,21 +10809,31 @@ "description": "Autofix for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7123,23 +10841,31 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7147,23 +10873,31 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7171,21 +10905,30 @@ "description": "Code scanning using the default setup was disabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -7194,21 +10937,30 @@ "description": "Code scanning using the default setup was enabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -7217,36 +10969,62 @@ "description": "The interaction limit for collaborators only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "request_id", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" - }, - { - "action": "org.config.disable_contributors_only", - "description": "The interaction limit for prior contributors only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", - "fields": [ + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", + "created_at" + ], + "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + }, + { + "action": "org.config.disable_contributors_only", + "description": "The interaction limit for prior contributors only for an organization was disabled.", + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ "@timestamp", - "created_at", - "user_agent", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", - "actor", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -7255,17 +11033,30 @@ "description": "The interaction limit for existing users only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", "_document_id", - "operation_type", - "actor_id", - "org_id", "action", - "created_at", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -7275,16 +11066,29 @@ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ "@timestamp", - "created_at", "_document_id", - "actor_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "action", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -7293,17 +11097,30 @@ "description": "The interaction limit for prior contributors only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "operation_type", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -7312,17 +11129,30 @@ "description": "The interaction limit for existing users only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "actor_id", - "request_id", + "@timestamp", + "_document_id", "action", - "created_at", - "user_agent", "actor", - "_document_id", - "org_id", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -7331,22 +11161,30 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" }, @@ -7355,17 +11193,28 @@ "description": "An invitation for an organization to join an enterprise was confirmed.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -7376,18 +11225,30 @@ "description": "An organization was created.", "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", "fields": [ - "request_id", - "org", - "actor_id", - "actor", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "org_id", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" }, @@ -7396,18 +11257,30 @@ "description": "An organization was deleted by a user or staff.", "docs_reference_links": "N/A", "fields": [ - "user_agent", "@timestamp", "_document_id", - "created_at", - "actor", - "org_id", - "org", "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7415,20 +11288,30 @@ "description": "Team creation was limited to owners.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "actor", "@timestamp", "_document_id", - "user", - "user_id", "action", - "created_at", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -7437,19 +11320,30 @@ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -7458,14 +11352,31 @@ "description": "SAML single sign-on was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sso_url", "issuer", - "action", - "@timestamp", - "_document_id", "created_at", - "org", "operation_type" ] }, @@ -7474,17 +11385,30 @@ "description": "A two-factor authentication requirement was disabled for the organization.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "org_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "_document_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7492,19 +11416,30 @@ "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "user", - "action", - "operation_type", "@timestamp", "_document_id", - "created_at", - "user_agent", - "org", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7512,19 +11447,30 @@ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "user", - "action", - "actor_id", - "org_id" + "created_at" ] }, { @@ -7532,19 +11478,30 @@ "description": "Team creation by members was allowed.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "org_id", - "user", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -7553,19 +11510,30 @@ "description": "An organization owner allowed users with read access to create discussions in an organization", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -7574,19 +11542,32 @@ "description": "SAML single sign-on was enabled for the organization.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", - "sso_url", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "@timestamp", - "issuer", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "sso_url", + "created_at", + "issuer" ], "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" }, @@ -7595,17 +11576,30 @@ "description": "Two-factor authentication is now required for the organization.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "actor_id", - "action", - "_document_id", - "org", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" }, @@ -7614,17 +11608,30 @@ "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "org_id", - "manager", "@timestamp", - "request_id", - "actor", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "manager", + "operation_type", "created_at" ] }, @@ -7633,18 +11640,31 @@ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", "docs_reference_links": "N/A", "fields": [ - "org_id", "@timestamp", - "org", - "user_agent", - "request_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "manager", "operation_type", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7652,23 +11672,32 @@ "description": "A new user was invited to join an organization.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", "fields": [ - "org", - "user_id", - "invitation_id", - "org_id", - "user", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", - "created_at", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "invitee_email", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitation_id", + "operation_type", + "created_at", + "invitee_email" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" }, @@ -7677,17 +11706,28 @@ "description": "An organization was invited to join an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7697,19 +11737,30 @@ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7717,19 +11768,30 @@ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "org", - "org_id", - "user_agent", - "actor_id", - "user_id", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7738,16 +11800,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "org_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type", - "_document_id", - "org" + "created_at", + "operation_type" ] }, { @@ -7755,17 +11830,30 @@ "description": "An organization was restored.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "org_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7773,19 +11861,31 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", "fields": [ - "actor", - "operation_type", "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "actor_is_bot", - "request_access_security_header" + "operation_type", + "created_at", + "actor_is_bot" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -7794,42 +11894,62 @@ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "user_id", - "user_agent", - "org_id", - "user", - "action", - "_document_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" - }, - { + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + }, + { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7837,21 +11957,30 @@ "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ - "org", - "user", - "org_id", - "created_at", - "request_id", "@timestamp", - "action", - "operation_type", - "user_agent", "_document_id", + "action", "actor", "actor_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7859,21 +11988,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -7881,18 +12020,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", "fields": [ - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "actor", - "action", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -7901,19 +12052,31 @@ "description": "An organization was renamed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "_document_id", "@timestamp", - "org", + "_document_id", "action", "actor", - "old_login", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_login", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -7921,20 +12084,30 @@ "description": "An organization member was restored.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", "fields": [ - "user", - "actor", - "user_id", + "@timestamp", "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "actor_id", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" }, @@ -7943,21 +12116,33 @@ "description": "A self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" @@ -7967,21 +12152,31 @@ "description": "A self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7990,48 +12185,66 @@ "description": "The REST API was used to remove a self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", - "runner_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", "programmatic_access_type", - "request_access_security_header" - ], - "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" - }, - { - "action": "org.runner_group_runners_added", - "description": "A self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", - "fields": [ - "user_agent", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "runner_group_id", - "org", - "org_id", - "action", + "runner_id", "operation_type", + "created_at" + ], + "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + }, + { + "action": "org.runner_group_runners_added", + "description": "A self-hosted runner was added to a group.", + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -8040,19 +12253,32 @@ "description": "A runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -8061,25 +12287,36 @@ "description": "The configuration of a self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -8088,21 +12325,30 @@ "description": "Automatic partner validation checks have been disabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -8112,21 +12358,30 @@ "description": "Automatic partner validation checks have been enabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -8136,20 +12391,30 @@ "description": "A custom pattern was created for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -8158,22 +12423,30 @@ "description": "A custom pattern was removed from secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -8182,21 +12455,30 @@ "description": "A custom pattern was published for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -8205,21 +12487,30 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -8228,22 +12519,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -8252,21 +12551,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -8275,21 +12583,30 @@ "description": "Secret scanning for non-provider patterns was disabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -8299,21 +12616,30 @@ "description": "Secret scanning for non-provider patterns was enabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -8323,19 +12649,30 @@ "description": "A role or team was added to the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -8345,21 +12682,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -8369,21 +12715,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -8393,19 +12748,30 @@ "description": "A role or team was removed from the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -8415,22 +12781,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8439,22 +12813,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8463,22 +12845,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8487,21 +12877,30 @@ "description": "Push protection for secret scanning was disabled.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8510,21 +12909,30 @@ "description": "Push protection for secret scanning was enabled.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8533,22 +12941,30 @@ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8557,22 +12973,30 @@ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8581,12 +13005,28 @@ "description": "The push protection setting was updated for a secret type for your organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "push_protection_setting", "secret_type", "secret_type_display_name", @@ -8599,12 +13039,28 @@ "description": "The push protection pattern configuration was updated for your organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at" ], "docs_reference_titles": "About push protection" @@ -8614,26 +13070,35 @@ "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -8642,26 +13107,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8669,28 +13142,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8698,26 +13179,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8725,15 +13214,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -8742,15 +13248,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -8759,7 +13282,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -8774,18 +13318,28 @@ "description": "The cache retention policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -8797,18 +13351,28 @@ "description": "The cache storage policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -8820,20 +13384,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -8842,16 +13417,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -8862,18 +13450,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -8882,17 +13483,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", "_document_id", - "org_id", - "operation_type", + "action", "actor", "actor_id", - "@timestamp", - "request_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", - "action" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8900,18 +13514,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -8920,18 +13546,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -8940,18 +13579,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -8960,22 +13611,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", "actor_id", - "org_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issuer", - "business", "operation_type", "created_at", - "request_id", - "business_id", - "_document_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8983,19 +13644,31 @@ "description": "A user account was converted into an organization.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization", "fields": [ - "actor", + "@timestamp", "_document_id", - "request_id", - "operation_type", + "action", + "actor", "actor_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "@timestamp", - "created_at", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "owner", - "request_access_security_header" + "operation_type", + "created_at", + "owner" ], "docs_reference_titles": "Converting a user into an organization" }, @@ -9004,19 +13677,32 @@ "description": "A user was unblocked from an organization.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", "fields": [ - "oauth_application_id", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", - "@timestamp", - "request_id", - "created_at", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "blocked_user", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" }, @@ -9025,23 +13711,34 @@ "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "updated_allowed_types", "old_policy", - "updated_access_policy", - "programmatic_access_type", - "request_access_security_header" + "updated_access_policy" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" }, @@ -9050,20 +13747,32 @@ "description": "The default repository permission level for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", + "created_at", "permission", - "actor_id", - "old_permission", - "_document_id", - "programmatic_access_type" + "old_permission" ] }, { @@ -9072,20 +13781,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -9093,17 +13813,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -9113,20 +13846,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -9135,19 +13879,32 @@ "description": "An organization's SAML provider settings were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "sso_url", - "actor_id", - "operation_type", "@timestamp", - "issuer", - "org", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "operation_type", + "issuer", + "created_at" ] }, { @@ -9155,18 +13912,30 @@ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", "fields": [ - "request_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "_document_id", - "org", - "action", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" }, @@ -9175,11 +13944,28 @@ "description": "A new organization custom property definition was created.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "description", @@ -9187,11 +13973,6 @@ "required", "allowed_values", "default_value", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -9203,11 +13984,28 @@ "description": "An organization custom property definition was deleted.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "description", @@ -9215,11 +14013,6 @@ "required", "allowed_values", "default_value", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -9231,20 +14024,32 @@ "description": "An organization custom property definition was updated.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "old_values_editable_by", "values_editable_by", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -9259,21 +14064,31 @@ "description": "An organization's custom property value was manually set for the first time.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -9285,21 +14100,31 @@ "description": "An organization's custom property value was deleted.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -9311,20 +14136,33 @@ "description": "A domain was approved for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner_type", - "domain_name", - "org_id", + "business", "business_id", - "owner", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "domain_name", + "owner", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" }, @@ -9333,16 +14171,31 @@ "description": "A domain was added to an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "created_at", + "@timestamp", "_document_id", - "domain_name", "action", - "request_id", + "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "domain_name", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -9351,14 +14204,29 @@ "description": "A domain was removed from an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", "fields": [ - "action", - "domain_name", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "domain_name", "operation_type", "created_at" ], @@ -9369,16 +14237,31 @@ "description": "A domain was verified for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "operation_type", - "domain_name", "@timestamp", - "user_agent", - "request_id", - "actor", - "action", - "created_at", "_document_id", - "actor_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "domain_name", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -9387,20 +14270,31 @@ "description": "An entire package was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" @@ -9410,23 +14304,34 @@ "description": "A package was published or republished to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "ecosystem", "version_count", "is_republished", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -9435,21 +14340,32 @@ "description": "A specific package version was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "version", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "ecosystem", "actor_is_bot" ], @@ -9460,21 +14376,34 @@ "description": "A specific package version was published or republished to a package.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "ecosystem", "package", "version", - "actor_id", - "user_agent", "is_republished", - "actor", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -9483,20 +14412,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -9505,17 +14448,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9526,20 +14484,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -9548,19 +14520,31 @@ "description": "A new passkey was added.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9568,19 +14552,31 @@ "description": "A new passkey was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9588,18 +14584,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9607,16 +14615,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -9624,18 +14646,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -9643,18 +14677,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9665,22 +14712,31 @@ "description": "The configured restriction for access to resources via personal access tokens was disabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9688,22 +14744,31 @@ "description": "The configured restriction for access to resources via personal access tokens was enabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9711,18 +14776,28 @@ "description": "The configured restriction for access to resources via personal access tokens was reset and delegated to organizations.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9733,18 +14808,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9755,18 +14843,28 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9777,18 +14875,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9799,18 +14907,28 @@ "description": "Triggered when the enterprise delegates to the organizations when to require approval for fine-grained personal access tokens before the tokens can access organization resources.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9821,17 +14939,30 @@ "description": "Triggered when you create a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9841,19 +14972,31 @@ "description": "Triggered when you regenerate a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9861,12 +15004,29 @@ "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", "fields": [ - "user_programmatic_access_name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", "operation_type" ], @@ -9877,20 +15037,32 @@ "description": "Triggered when you delete a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "explanation", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9898,23 +15070,34 @@ "description": "A personal access token expiration limit was set.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "token_expiration", "old_token_expiration", "exempt_administrators", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9922,39 +15105,63 @@ "description": "A personal access token expiration limit was unset.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "programmatic_access_type", - "old_token_expiration", "business", "business_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "actor_is_bot", - "request_access_security_header" - ] - }, - { - "action": "personal_access_token.request_cancelled", - "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "user_programmatic_access_name", + "hashed_token", "org", "org_id", - "repository_selection", - "action", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_token_expiration", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, + { + "action": "personal_access_token.request_cancelled", + "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", + "repository_selection", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9965,18 +15172,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9988,17 +15208,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -10010,17 +15243,30 @@ "description": "A fine-grained personal access token was updated.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -10031,15 +15277,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -10049,17 +15310,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -10069,15 +15341,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -10087,17 +15374,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -10107,17 +15405,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -10127,17 +15436,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -10147,17 +15467,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -10167,17 +15498,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -10187,17 +15531,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -10205,20 +15562,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -10228,25 +15596,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -10254,20 +15634,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -10275,25 +15667,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -10301,17 +15705,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -10319,17 +15736,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -10337,18 +15767,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -10357,18 +15799,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -10377,19 +15831,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -10397,17 +15862,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -10419,22 +15897,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -10442,19 +15929,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -10462,17 +15960,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -10480,18 +15991,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -10499,20 +16023,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -10520,38 +16054,62 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -10560,16 +16118,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -10581,21 +16152,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -10603,22 +16186,32 @@ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", "fields": [ - "repo", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "name", "created_at", - "_document_id", "operation_type", - "actor", - "repo_id", - "org", - "request_id", - "actor_id", - "oauth_application_id", - "@timestamp", - "programmatic_access_type" + "oauth_application_id" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" }, @@ -10627,29 +16220,34 @@ "description": "A protected branch allowance was given to a specific user, team or integration.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "authorized_actors", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -10657,24 +16255,32 @@ "description": "Branch protection was enabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "repo_id", - "user_id", "@timestamp", - "user_agent", - "repo", - "name", - "org_id", - "user", "_document_id", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", "created_at", "authorized_actor_names", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -10685,21 +16291,31 @@ "description": "Branch protection was disabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "repo", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", - "request_id", - "repo_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "name", + "operation_type", "created_at", - "_document_id", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -10710,22 +16326,32 @@ "description": "Enforcement of dismissing stale pull requests was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "dismiss_stale_reviews_on_push", - "org_id", - "action", - "created_at", - "request_id", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismiss_stale_reviews_on_push", + "created_at", "operation_type", - "actor", - "repo", - "org", - "name", - "programmatic_access_type" + "name" ] }, { @@ -10733,24 +16359,34 @@ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", - "oauth_application_id", - "authorized_actors_only", - "authorized_actors", - "created_at", - "user_agent", - "name", - "_document_id", - "org_id", - "request_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "operation_type", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "authorized_actors_only", + "authorized_actors", + "created_at", + "name", + "operation_type" ] }, { @@ -10758,30 +16394,37 @@ "description": "A branch protection requirement was overridden by a repository administrator.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "actor", "reasons", - "@timestamp", "before", "after", - "actor_id", - "repo", "operation_type", - "user_agent", "branch", "overridden_codes", - "org", - "org_id", - "action", - "_document_id", - "request_id", "referrer", - "business", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "rule_suite_id" ] @@ -10791,28 +16434,36 @@ "description": "A branch update attempt was rejected.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "request_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "branch", "before", "overridden_codes", "after", - "action", "reasons", - "actor_id", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "actor_is_bot", "rule_suite_id" @@ -10823,23 +16474,32 @@ "description": "Branch protection was enforced for repository administrators.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "admin_enforced", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "name", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "action", "repo_id", - "org_id", - "_document_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "admin_enforced", + "operation_type", + "name", + "created_at" ] }, { @@ -10847,22 +16507,32 @@ "description": "Branch deletion was enabled or disabled for a protected branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "operation_type", - "request_id", - "repo", "@timestamp", - "org_id", - "org", - "action", - "allow_deletions_enforcement_level", "_document_id", - "created_at", - "actor_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_deletions_enforcement_level", + "created_at" ] }, { @@ -10870,23 +16540,32 @@ "description": "Force pushes were enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "actor_id", - "name", + "@timestamp", "_document_id", + "action", "actor", - "repo", - "operation_type", - "request_id", - "allow_force_pushes_enforcement_level", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_force_pushes_enforcement_level", + "created_at" ] }, { @@ -10894,24 +16573,33 @@ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "ignore_approvals_from_contributors", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -10920,22 +16608,32 @@ "description": "Required linear commit history was enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "operation_type", "actor", - "linear_history_requirement_enforcement_level", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "linear_history_requirement_enforcement_level", "name", - "org_id", - "repo_id", - "org", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ] }, { @@ -10943,24 +16641,33 @@ "description": "Fork syncing was enabled or disabled for a read-only branch", "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "lock_allows_fetch_and_merge", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -10969,27 +16676,34 @@ "description": "The enforcement of a branch lock was updated.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "enforcement_level", "lock_branch_enforcement_level", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -10998,18 +16712,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -11020,24 +16747,33 @@ "description": "A branch name pattern was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "old_name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "old_name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -11045,25 +16781,32 @@ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", "docs_reference_links": "N/A", "fields": [ - "name", - "org_id", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "@timestamp", + "business", "business_id", - "request_id", - "pull_request_reviews_enforcement_level", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "business", - "user_agent", - "created_at", "repo_id", - "operation_type", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "pull_request_reviews_enforcement_level", + "created_at", + "operation_type" ] }, { @@ -11071,22 +16814,32 @@ "description": "Enforcement of required code owner review was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "created_at", - "require_code_owner_review", - "operation_type", - "name", - "user_agent", - "action", "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "request_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "require_code_owner_review", + "operation_type", + "name" ] }, { @@ -11094,22 +16847,33 @@ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "require_last_push_approval", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" }, @@ -11118,22 +16882,32 @@ "description": "Enforcement of the required number of approvals before merging was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "required_approving_review_count", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "required_approving_review_count", "created_at", - "actor", "operation_type", - "user_agent", - "name", - "org_id", - "action", - "actor_id", - "_document_id", - "org", - "@timestamp", - "programmatic_access_type" + "name" ] }, { @@ -11141,25 +16915,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "user_agent", "@timestamp", "_document_id", - "name", - "repo", "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "business", - "actor_id", - "operation_type", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "required_status_checks_enforcement_level", - "org", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "required_status_checks_enforcement_level" ] }, { @@ -11167,22 +16948,32 @@ "description": "Enforcement of required commit signing was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "name", "@timestamp", - "created_at", "_document_id", - "request_id", - "repo_id", - "org", - "org_id", "action", "actor", "actor_id", - "signature_requirement_enforcement_level", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "programmatic_access_type" + "operation_type", + "name", + "created_at", + "signature_requirement_enforcement_level" ] }, { @@ -11190,22 +16981,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "created_at", - "repo_id", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "name", - "actor", - "repo", "operation_type", - "action", - "strict_required_status_checks_policy", - "programmatic_access_type" + "strict_required_status_checks_policy" ] }, { @@ -11213,23 +17014,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -11238,24 +17050,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -11264,20 +17087,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -11286,21 +17123,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -11310,22 +17160,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -11334,25 +17196,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -11361,23 +17233,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", - "created_at", - "key", - "fingerprint", - "actor_id", "actor", - "title", - "user_agent", - "user_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "read_only", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "key", + "fingerprint", + "title", + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -11386,18 +17269,32 @@ "description": "A pull request was closed without being merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" @@ -11407,21 +17304,32 @@ "description": "A pull request was converted to a draft.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" }, @@ -11430,19 +17338,32 @@ "description": "A pull request was created.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -11453,23 +17374,35 @@ "description": "A review was requested on a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -11479,17 +17412,31 @@ "description": "A pull request was marked as in progress.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11497,19 +17444,32 @@ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -11517,19 +17477,32 @@ "description": "A pull request was merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" @@ -11539,21 +17512,32 @@ "description": "A pull request was marked as ready for review.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" }, @@ -11562,27 +17546,34 @@ "description": "A pull request was rebased.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", - "pull_request_url", - "pull_request_title", - "user", - "user_id", - "repo", - "repo_id", - "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", + "pull_request_url", + "pull_request_title", + "public_repo", + "created_at", + "operation_type" ] }, { @@ -11590,23 +17581,35 @@ "description": "A review request was removed from a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" }, @@ -11615,18 +17618,32 @@ "description": "A pull request was reopened after previously being closed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -11634,19 +17651,31 @@ "description": "A review comment was added to a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "comment_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -11656,20 +17685,31 @@ "description": "A review comment on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", "@timestamp", "_document_id", - "repo", - "created_at", - "request_id", - "comment_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "comment_id", + "operation_type" ] }, { @@ -11677,18 +17717,31 @@ "description": "A review comment on a pull request was changed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "request_id", - "actor_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "_document_id", - "@timestamp", - "comment_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "comment_id" ] }, { @@ -11696,21 +17749,33 @@ "description": "A review on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ] }, { @@ -11718,20 +17783,33 @@ "description": "A review on a pull request was dismissed.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" }, @@ -11740,19 +17818,33 @@ "description": "A review on a pull request was submitted.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" @@ -11762,22 +17854,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", - "actor_id", - "user_id", - "created_at", - "user_agent", - "actor", + "_document_id", "action", - "repo", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -11786,21 +17888,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -11809,25 +17920,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -11836,23 +17954,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -11861,24 +17987,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -11887,23 +18020,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -11913,22 +18054,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -11937,19 +18087,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -11958,24 +18121,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -11984,24 +18157,32 @@ "description": "Autofix for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "public_repo", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -12009,24 +18190,32 @@ "description": "Autofix for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -12034,24 +18223,32 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -12059,24 +18256,32 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -12084,23 +18289,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -12111,17 +18325,29 @@ "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -12131,17 +18357,29 @@ "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -12151,25 +18389,31 @@ "description": "Code scanning using the default setup was disabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -12178,26 +18422,34 @@ "description": "Code scanning using the default setup was enabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "query_suite", "threat_model", - "languages", - "request_access_security_header" + "languages" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -12206,25 +18458,34 @@ "description": "Code scanning using the default setup was updated for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "query_suite", - "threat_model", - "languages", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "query_suite", + "threat_model", + "languages", + "public_repo", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Configuring default setup for code scanning" @@ -12234,20 +18495,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "visibility", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -12255,17 +18527,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -12274,15 +18559,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -12293,16 +18591,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -12312,17 +18623,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -12332,19 +18656,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -12353,17 +18688,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -12372,26 +18720,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -12400,31 +18754,36 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ - "repo", - "user_id", - "visibility", - "repo_id", - "user", - "request_id", - "actor_id", - "action", - "operation_type", - "request_category", "@timestamp", - "created_at", "_document_id", + "action", "actor", - "user_agent", - "org", - "oauth_application_id", - "org_id", - "request_method", + "actor_id", "business", "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "request_category", + "created_at", + "oauth_application_id", + "request_method", + "public_repo", + "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" }, @@ -12433,20 +18792,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12455,25 +18825,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12482,23 +18860,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -12506,25 +18895,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -12534,17 +18932,30 @@ "description": "A repository was archived on disk.", "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories", "fields": [ - "actor_id", - "repo", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", - "repo_id", - "actor", "action", - "user_agent" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/archiving-a-github-repository/archiving-repositories" }, @@ -12553,23 +18964,32 @@ "description": "A source code archive of a repository was downloaded as a ZIP file.", "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "created_at", "operation_type", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" @@ -12579,62 +18999,95 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "visibility", - "repo_id", - "created_at", - "actor", - "action", - "@timestamp", "org_id", - "request_id", + "programmatic_access_type", "repo", - "_document_id" - ] - }, - { - "action": "repo.noindex", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "visibility", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", - "actor_id", - "created_at", + "token_id", + "token_scopes", "user", - "operation_type", - "actor", - "user_agent", - "repo", "user_id", - "public_repo" + "user_agent", + "operation_type", + "visibility", + "created_at" ] }, { - "action": "repo.override_unlock", - "description": "The repository was unlocked.", + "action": "repo.noindex", + "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", "operation_type", + "public_repo" + ] + }, + { + "action": "repo.override_unlock", + "description": "The repository was unlocked.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "created_at", - "_document_id" + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -12642,20 +19095,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "action", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "operation_type", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "visibility", - "actor", - "user_id" + "visibility" ] }, { @@ -12663,23 +19127,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -12687,21 +19161,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -12709,21 +19193,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -12731,22 +19225,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -12754,21 +19257,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -12776,20 +19289,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -12797,22 +19321,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -12820,18 +19353,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -12839,22 +19386,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -12862,21 +19419,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -12884,18 +19451,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -12904,22 +19483,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12928,24 +19516,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12954,23 +19550,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -12978,26 +19584,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -13006,21 +19617,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -13029,25 +19649,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -13055,22 +19681,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -13079,20 +19715,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "visibility", - "operation_type", - "repo", + "@timestamp", "_document_id", - "user", - "user_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "@timestamp", - "request_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -13100,19 +19747,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -13120,17 +19778,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -13139,17 +19812,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -13158,7 +19846,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -13173,22 +19882,30 @@ "description": "The cache retention policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -13200,22 +19917,30 @@ "description": "The cache storage policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -13227,23 +19952,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -13253,20 +19987,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -13277,21 +20022,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -13300,22 +20056,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -13324,21 +20090,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -13347,22 +20124,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -13373,16 +20160,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -13391,22 +20189,31 @@ "description": "Temporary access was enabled for a repository.", "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing user-owned repositories in your enterprise" }, @@ -13416,22 +20223,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", - "actor_id", - "repo_id", - "owner", - "user", - "old_user", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", + "old_user", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -13440,23 +20258,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -13466,19 +20294,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -13486,21 +20324,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -13509,24 +20357,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -13534,25 +20391,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -13561,24 +20425,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13587,25 +20461,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -13614,22 +20496,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13638,26 +20529,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -13665,31 +20564,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13698,24 +20604,30 @@ "description": "Branch protections were disabled for the repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -13724,24 +20636,30 @@ "description": "Branch protections were enabled for this repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -13750,25 +20668,31 @@ "description": "Code security was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -13777,25 +20701,31 @@ "description": "Code security was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -13804,21 +20734,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -13826,21 +20766,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -13848,21 +20798,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -13870,20 +20831,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -13891,21 +20864,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -13913,19 +20897,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -13933,31 +20930,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -13966,19 +20971,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -13986,8 +21002,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -13996,23 +21011,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -14037,26 +21061,32 @@ "description": "Automatic partner validation checks have been disabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -14065,26 +21095,32 @@ "description": "Automatic partner validation checks have been enabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -14093,49 +21129,63 @@ "description": "A custom pattern was created for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "public_repo" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "public_repo" + ], + "docs_reference_titles": "Defining custom patterns for secret scanning" + }, + { "action": "repository_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14145,24 +21195,31 @@ "description": "A custom pattern was published for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14172,24 +21229,31 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -14198,24 +21262,31 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14225,23 +21296,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14251,23 +21329,31 @@ "description": "Secret scanning was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "public_repo", - "programmatic_access_type" + "public_repo" ], "docs_reference_titles": "About secret scanning" }, @@ -14276,22 +21362,30 @@ "description": "Secret scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14299,24 +21393,32 @@ "description": "Secret scanning for non-provider patterns was disabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -14325,24 +21427,32 @@ "description": "Secret scanning for non-provider patterns was enabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -14351,19 +21461,31 @@ "description": "A role or team was added to the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -14372,24 +21494,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -14398,24 +21528,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -14424,19 +21562,31 @@ "description": "A role or team was removed from the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -14445,26 +21595,31 @@ "description": "Secret scanning push protection was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -14473,26 +21628,31 @@ "description": "Secret scanning push protection was enabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -14501,28 +21661,36 @@ "description": "A code security configuration was applied to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14530,27 +21698,35 @@ "description": "A code security configuration failed to attach to the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14558,28 +21734,36 @@ "description": "A code security configuration was removed from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14587,28 +21771,36 @@ "description": "A code security configuration was removed due to a change in repository or enterprise settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14616,29 +21808,37 @@ "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -14647,29 +21847,37 @@ "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -14678,19 +21886,32 @@ "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ - "operation_type", - "request_id", - "repo_id", "@timestamp", - "user_agent", - "alert_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "alert_id", + "created_at", + "alert_number" ], "docs_reference_titles": "About Dependabot alerts" }, @@ -14699,23 +21920,32 @@ "description": "A Dependabot alert was manually dismissed.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "operation_type", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "alert_id", - "actor", - "repo", "created_at", - "org", - "_document_id", - "action", - "actor_id", "dismiss_reason", - "user", "dismiss_comment", "alert_number", "actor_is_bot" @@ -14726,21 +21956,33 @@ "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "public_repo", "owner", - "_document_id", - "@timestamp", "operation_type", - "token_scopes", "alert_number" ] }, @@ -14749,26 +21991,34 @@ "description": "A Dependabot alert was manually reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type", - "business", - "business_id", "public_repo", - "alert_number", - "request_access_security_header" + "alert_number" ] }, { @@ -14776,21 +22026,32 @@ "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", "docs_reference_links": "N/A", "fields": [ - "alert_id", - "repo", - "operation_type", - "action", - "repo_id", - "_document_id", - "user_agent", - "request_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "alert_id", + "operation_type", + "created_at", + "alert_number" ] }, { @@ -14798,21 +22059,35 @@ "description": "A Dependabot alert was withdrawn.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", "created_at", "active", - "action", - "repository_id", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type" ] }, @@ -14821,20 +22096,30 @@ "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", "fields": [ - "org", + "@timestamp", "_document_id", - "repo", - "org_id", - "operation_type", - "created_at", - "actor", "action", - "@timestamp", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" }, @@ -14843,24 +22128,31 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -14868,26 +22160,32 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14895,23 +22193,30 @@ "description": "Dependabot alerts was disabled.", "docs_reference_links": "N/A", "fields": [ - "repo", - "request_id", - "repo_id", - "action", - "actor_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "_document_id", "user_id", - "operation_type", - "token_scopes", - "programmatic_access_type" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14919,23 +22224,30 @@ "description": "Dependabot alerts was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_agent", - "created_at", "@timestamp", - "repo_id", + "_document_id", "action", - "user", - "repo", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor_id", - "_document_id", - "user_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot" ] }, @@ -14944,18 +22256,31 @@ "description": "Email notification restrictions for an organization or enterprise were disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -14964,19 +22289,31 @@ "description": "Email notification restrictions for an organization or enterprise were enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -14985,14 +22322,28 @@ "description": "A user was assigned to a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15007,14 +22358,28 @@ "description": "GitHub detected a secret and created a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15028,22 +22393,32 @@ "description": "A secret scanning alert was reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type_display_name" ] }, @@ -15052,28 +22427,37 @@ "description": "A secret scanning alert was resolved.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "resolution", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", + "resolution", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type", "secret_type_display_name", "publicly_leaked", - "multi_repo", - "request_access_security_header" + "multi_repo" ] }, { @@ -15081,25 +22465,32 @@ "description": "A secret scanning alert was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -15107,14 +22498,28 @@ "description": "A user was unassigned from a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15129,14 +22534,28 @@ "description": "A secret scanning alert was validated.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "previous_validity", @@ -15153,19 +22572,30 @@ "description": "Secret scanning was disabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -15174,62 +22604,94 @@ "description": "Secret scanning was enabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" - ], - "docs_reference_titles": "About secret scanning" - }, - { - "action": "secret_scanning_new_repos.disable", - "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", - "fields": [ - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", + "user_agent", "created_at", - "_document_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About secret scanning" }, { - "action": "secret_scanning_new_repos.enable", - "description": "Secret scanning was enabled for all new repositories.", + "action": "secret_scanning_new_repos.disable", + "description": "Secret scanning was disabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", + "created_at" + ], + "docs_reference_titles": "About secret scanning" + }, + { + "action": "secret_scanning_new_repos.enable", + "description": "Secret scanning was enabled for all new repositories.", + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ "@timestamp", - "_document_id" + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -15238,14 +22700,28 @@ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "push_protection_bypass_reason", @@ -15263,25 +22739,33 @@ "description": "A request to bypass secret scanning push protection was approved by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -15290,25 +22774,33 @@ "description": "A request to bypass secret scanning push protection was denied by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", - "request_access_security_header", "request_reviewer_comment" ], "docs_reference_titles": "About push protection" @@ -15318,25 +22810,33 @@ "description": "A user requested to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" }, @@ -15345,22 +22845,35 @@ "description": "A secret scanning scan has completed on this repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "repo_id", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "source", "type", "source_slug", "type_slug", "started_at", "completed_at", - "repo", "public_repo", - "org", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "secret_types", @@ -15374,10 +22887,28 @@ "description": "A security configuration was created", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15392,15 +22923,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -15418,22 +22942,33 @@ "description": "A default security configuration setting for new repositories was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15442,22 +22977,33 @@ "description": "A default security configuration setting for new repositories was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "default_for_new_private_repos", - "default_for_new_public_repos", - "security_configuration_name", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "default_for_new_private_repos", + "default_for_new_public_repos", + "security_configuration_name", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15466,10 +23012,28 @@ "description": "A security configuration was deleted", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15484,15 +23048,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -15509,15 +23066,30 @@ "description": "A security configuration policy was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enforcement", "security_configuration_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15527,10 +23099,28 @@ "description": "A security configuration was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15545,15 +23135,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -15571,18 +23154,30 @@ "description": "A security key was registered for an account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "created_at", - "user_id", - "action", - "operation_type", - "request_id", "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -15590,18 +23185,30 @@ "description": "A security key was removed from an account.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "operation_type", - "_document_id", - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15609,14 +23216,28 @@ "description": "A user linked a social identity to their account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -15626,14 +23247,28 @@ "description": "A user unlinked a social identity from their account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "action", - "_document_id", - "@timestamp", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -15643,15 +23278,28 @@ "description": "A user unlinked all social identities from their account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -15661,16 +23309,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15680,18 +23341,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -15700,16 +23374,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15720,15 +23407,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -15738,15 +23438,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -15755,17 +23470,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -15774,17 +23502,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -15793,16 +23535,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -15812,14 +23567,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -15829,17 +23599,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -15848,17 +23631,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -15867,18 +23663,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "sponsors_listing_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sponsors_listing_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15887,15 +23696,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -15905,16 +23728,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -15922,15 +23758,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -15941,16 +23790,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -15960,17 +23822,30 @@ "description": "Triggered when you send an email update to your sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", "fields": [ - "request_id", - "actor", - "action", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" }, @@ -15979,17 +23854,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -16000,17 +23888,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -16021,18 +23922,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16042,16 +23954,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16061,17 +23986,30 @@ "description": "You join the waitlist to join GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_id", - "user_agent", "actor_id", - "action", - "operation_type", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "_document_id" + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -16080,16 +24018,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16101,17 +24052,30 @@ "fields": [ "@timestamp", "_document_id", - "fingerprint", - "operation_type", - "openssh_public_key", - "org_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "request_id" + "fingerprint", + "operation_type", + "openssh_public_key", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16120,19 +24084,32 @@ "description": "An SSH certificate authority for an organization or enterprise was deleted.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "created_at", + "@timestamp", "_document_id", - "fingerprint", - "operation_type", + "action", "actor", - "org_id", - "openssh_public_key", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", - "request_id" + "created_at", + "fingerprint", + "operation_type", + "openssh_public_key" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16141,21 +24118,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "user", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "request_id", - "org", - "org_id", - "created_at", - "actor", "action", - "user_id", + "actor", + "actor_id", "business", "business_id", - "@timestamp", - "actor_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16164,19 +24150,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "actor_id", - "user_id", - "org", - "operation_type", - "request_id", "@timestamp", "_document_id", - "actor", - "user", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16185,20 +24182,34 @@ "description": "The verification code expiry time for an organization or enterprise domain was set.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "token_expires_at", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16206,18 +24217,33 @@ "description": "An organization or enterprise domain was unverified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ] }, { @@ -16225,16 +24251,31 @@ "description": "An organization or enterprise domain was verified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "domain_name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16242,47 +24283,67 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "actor_is_bot", - "request_access_security_header" - ] + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", + "public_repo", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "sub_issues.parent_issue_remove", "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16290,23 +24351,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16314,23 +24385,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16338,15 +24419,30 @@ "description": "Triggered when you accept a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -16355,15 +24451,30 @@ "description": "Triggered when you cancel a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -16372,15 +24483,30 @@ "description": "Triggered when you create a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -16389,15 +24515,30 @@ "description": "Triggered when you decline a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -16406,15 +24547,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16422,38 +24578,63 @@ "description": "Triggered when you revoke a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ], - "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" - }, - { - "action": "team.add_member", - "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", - "fields": [ - "user_agent", - "request_id", - "org_id", - "user_id", - "team", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "actor_id", - "created_at", + "user_id", + "user_agent", "operation_type", + "created_at" + ], + "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" + }, + { + "action": "team.add_member", + "description": "A member of an organization was added to a team.", + "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", + "fields": [ + "@timestamp", "_document_id", - "org", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" @@ -16463,22 +24644,31 @@ "description": "A team was given access and permissions to a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "team", - "action", - "operation_type", - "request_id", - "created_at", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "actor_id", - "_document_id", "repo_id", - "user_agent", - "org_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -16487,20 +24677,30 @@ "description": "A team was added to an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team_type", "team", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -16511,20 +24711,31 @@ "description": "A child team was created or a child team's parent was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", "fields": [ - "org", "@timestamp", - "created_at", "_document_id", - "team", "action", - "operation_type", "actor", - "request_id", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", + "operation_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" }, @@ -16533,18 +24744,31 @@ "description": "A team's privacy level was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", "fields": [ - "user_agent", - "request_id", - "org", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", "created_at", "operation_type", - "actor_id", - "org_id", - "@timestamp", - "actor", - "_document_id", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" @@ -16554,21 +24778,32 @@ "description": "A new team is created.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "oauth_application_id", + "operation_type", "team", - "org", - "actor", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "team_type" ] }, @@ -16577,21 +24812,31 @@ "description": "A user was demoted from a team maintainer to a team member.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" }, @@ -16600,19 +24845,31 @@ "description": "A team was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "team", "org_id", - "actor_id", - "actor", - "action", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", "operation_type", - "_document_id", - "programmatic_access_type", "team_type" ] }, @@ -16621,19 +24878,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "business_id", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", "actor_id", - "user", "business", - "action", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16641,19 +24909,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "operation_type", - "request_id", "actor", - "org", - "created_at", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", - "_document_id" + "operation_type", + "created_at" ] }, { @@ -16661,18 +24940,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", "@timestamp", - "action", "_document_id", - "user_agent", - "user_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business", + "user_id", + "user_agent", "operation_type", - "actor", "created_at" ] }, @@ -16681,22 +24971,31 @@ "description": "A user was promoted from a team member to a team maintainer.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" }, @@ -16705,20 +25004,30 @@ "description": "A team was removed from an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team_type", "team", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -16729,22 +25038,31 @@ "description": "An organization member was removed from a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", "fields": [ - "request_id", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "team", - "user_id", - "actor", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", + "user_id", "user_agent", - "_document_id", - "token_scopes", - "programmatic_access_type", + "operation_type", + "created_at", + "team", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" @@ -16754,21 +25072,31 @@ "description": "A repository was removed from a team's control.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "org_id", - "repo", - "repo_id", - "action", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "created_at", "team", - "org", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -16776,21 +25104,32 @@ "description": "A team's name was changed.", "docs_reference_links": "N/A", "fields": [ - "name", - "user_agent", - "created_at", - "team", - "operation_type", - "actor_id", - "org", + "@timestamp", + "_document_id", "action", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "_document_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "team", + "operation_type", "team_type" ] }, @@ -16799,17 +25138,30 @@ "description": "Team synchronization with a tenant was disabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "request_id", - "org_id", "actor_id", - "operation_type", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -16818,49 +25170,69 @@ "description": "Team synchronization with a tenant was enabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ - "org_id", - "business_id", - "actor", - "created_at", - "user_agent", "@timestamp", - "operation_type", - "business", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id" - ], - "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, { "action": "team.update_repository_permission", "description": "A team's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "team", - "org_id", "@timestamp", - "org", "_document_id", - "old_permission", - "request_id", - "repo", "action", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "old_permission", "operation_type", "created_at", - "user_agent", "permission", "new_repo_permission", "new_repo_base_role", "old_repo_permission", - "old_repo_base_role", - "token_scopes", - "programmatic_access_type" + "old_repo_base_role" ] }, { @@ -16868,17 +25240,30 @@ "description": "A new trusted device was added.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16886,17 +25271,30 @@ "description": "A trusted device was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16904,14 +25302,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "action", - "request_id", - "user_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -16920,15 +25333,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "created_at", - "user_id", - "operation_type", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action" + "created_at", + "operation_type" ] }, { @@ -16936,13 +25364,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "created_at", - "user_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16950,17 +25395,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "operation_type", - "action", - "_document_id" + "created_at", + "operation_type" ] }, { @@ -16968,17 +25426,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user", - "created_at", - "request_id", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -16986,16 +25457,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17003,34 +25488,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_id", - "action", "@timestamp", - "created_at", - "user_agent", - "user", "_document_id", - "request_id" - ] - }, - { - "action": "two_factor_authentication.add_factor", - "description": "A secondary authentication factor was added to a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", - "fields": [ + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "two_factor_authentication.add_factor", + "description": "A secondary authentication factor was added to a user account.", + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -17039,18 +25551,30 @@ "description": "Two-factor authentication was disabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", "fields": [ - "actor", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor_id", + "user_agent", "created_at", - "operation_type", - "request_id", - "@timestamp", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Disabling two-factor authentication for your personal account" }, @@ -17059,18 +25583,30 @@ "description": "Two-factor authentication was enabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ - "actor", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Configuring two-factor authentication" }, @@ -17079,15 +25615,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user", - "user_id", - "action", "@timestamp", - "request_id", "_document_id", - "user_agent" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17095,16 +25646,29 @@ "description": "Two factor recovery codes were regenerated for a user account.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", + "operation_type", "created_at" ] }, @@ -17113,18 +25677,30 @@ "description": "A secondary authentication factor was removed from a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -17133,15 +25709,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "created_at", - "_document_id", - "action", - "@timestamp" + "operation_type", + "created_at" ] }, { @@ -17150,16 +25741,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "operation_type", "user_agent", - "action", - "request_id", - "actor", - "actor_id" + "created_at", + "operation_type" ] }, { @@ -17167,19 +25771,31 @@ "description": "An email address was added to a user account.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", "operation_type", - "_document_id", - "actor_id", - "actor", "email", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding an email address to your GitHub account" }, @@ -17188,18 +25804,30 @@ "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "created_at", - "user", "@timestamp", "_document_id", - "request_id", - "actor_id", - "operation_type", - "user_agent", "action", - "request_access_security_header" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17207,15 +25835,28 @@ "description": "Audit log entries were exported.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "action", - "request_id", - "actor", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", "created_at" ] @@ -17225,20 +25866,31 @@ "description": "A user was blocked by another user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_id", - "_document_id", "actor_id", - "@timestamp", - "user_agent", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -17246,18 +25898,30 @@ "description": "A user changed their password.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "actor_id", - "operation_type", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "created_at", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17265,18 +25929,30 @@ "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -17285,17 +25961,30 @@ "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -17304,23 +25993,38 @@ "description": "Triggered when a user content edit is deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_content_id", "user_content_type", "created_at", - "user_agent", "deleted_by", "editor_id", - "_document_id", "deleted_at", - "action", - "actor_id", "editor", "deleted_by_id", "deleted_content", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -17328,16 +26032,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "user_agent", - "created_at", - "user", "action", - "operation_type", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17345,16 +26063,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "_document_id", "@timestamp", - "created_at", - "user_agent", - "operation_type", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17362,58 +26094,96 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "created_at", - "_document_id", - "user_agent", - "user_id", - "@timestamp", - "user", - "action", - "request_access_security_header" - ] - }, - { - "action": "user.create", - "description": "A new user account was created.", - "docs_reference_links": "N/A", - "fields": [ - "email", - "user_id", - "operation_type", "@timestamp", - "request_id", - "user", - "created_at", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "action", - "programmatic_access_type" - ] + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "user.create", + "description": "A new user account was created.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "email", + "operation_type", + "created_at" + ] }, { "action": "user.create_integration_secret", "description": "A user secret for Codespaces was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17421,20 +26191,31 @@ "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "user_agent", + "@timestamp", "_document_id", - "operation_type", - "oauth_application_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "@timestamp", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -17442,18 +26223,30 @@ "description": "A user account was destroyed by an asynchronous job.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "request_id", - "user_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17462,19 +26255,30 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "oauth_application_id", + "_document_id", "action", - "user", - "created_at", - "user_agent", - "request_id", "actor", "actor_id", - "operation_type", - "_document_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", + "operation_type" ] }, { @@ -17482,18 +26286,30 @@ "description": "A user deleted his or her account, triggering user.async_delete.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", - "created_at", - "user_agent", "user_id", - "operation_type", - "actor_id", - "action", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17501,18 +26317,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "user_agent", "user_id", - "actor_id", - "action", - "operation_type", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17520,18 +26348,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "operation_type", - "created_at", - "_document_id", - "@timestamp", - "user", - "actor_id", - "action", - "request_access_security_header" + "created_at" ] }, { @@ -17540,35 +26380,60 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user", "_document_id", "action", - "operation_type", - "user_agent", - "created_at", - "request_id", "actor", "actor_id", - "user_id", - "request_access_security_header" - ] - }, - { - "action": "user.disable_collaborators_only", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "user.disable_collaborators_only", "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -17576,17 +26441,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -17594,17 +26472,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -17612,21 +26503,31 @@ "description": "An enterprise managed user claimed an email address.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -17634,21 +26535,31 @@ "description": "N/A", "docs_reference_links": "An enterprise managed user unclaimed an email address.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." }, @@ -17657,17 +26568,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -17675,17 +26599,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -17693,17 +26630,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -17711,18 +26661,30 @@ "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "action", - "operation_type", - "request_id", - "created_at", - "_document_id", "@timestamp", - "user", - "org_id", + "_document_id", + "action", "actor", "actor_id", - "user_agent" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17730,35 +26692,62 @@ "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.", "docs_reference_links": "N/A", "fields": [ - "actor", - "actor_id", - "operation_type", "@timestamp", - "request_id", - "user", - "user_id", - "action", "_document_id", - "user_agent", - "created_at" - ] + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] }, { "action": "user.forgot_password", "description": "A user requested a password reset.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", "fields": [ - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "email", - "created_at", - "user_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" }, @@ -17767,17 +26756,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "created_at", - "user_agent", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor", - "operation_type", - "request_id" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17785,18 +26787,30 @@ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -17805,19 +26819,31 @@ "description": "A user signed in.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "actor_id", "@timestamp", - "user", - "action", - "operation_type", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "actor", - "passkey_nickname", - "request_access_security_header" + "passkey_nickname" ] }, { @@ -17825,18 +26851,30 @@ "description": "A user signed out.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17844,19 +26882,30 @@ "description": "A comment made by a user was minimized.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", - "actor_id", "@timestamp", - "created_at", - "operation_type", "_document_id", - "user", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17864,18 +26913,30 @@ "description": "A user signed in from a new device.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17883,14 +26944,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", "_document_id", "action", - "@timestamp", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17898,21 +26975,31 @@ "description": "An ordinary user account was promoted to a site administrator.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", + "user_id", "user_agent", + "created_at", "oauth_application_id", - "request_id", - "operation_type", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17920,16 +27007,29 @@ "description": "A user's account was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user", - "action", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "actor", "operation_type" ] }, @@ -17938,20 +27038,31 @@ "description": "An email address was removed from a user account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "actor", - "actor_id", "created_at", - "email", - "token_scopes", - "programmatic_access_type" + "email" ] }, { @@ -17959,20 +27070,32 @@ "description": "A user secret for Codespaces was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "key", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "key", + "integration", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17980,17 +27103,30 @@ "description": "A user account was no longer flagged as a large scale contributor.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -17998,20 +27134,31 @@ "description": "A username was changed.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "request_id", - "actor_id", - "old_login", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "operation_type", "user_agent", - "token_scopes", - "programmatic_access_type" + "old_login", + "created_at", + "operation_type" ] }, { @@ -18019,17 +27166,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "user_agent", - "request_id", - "action", "@timestamp", - "created_at", - "org_id", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -18038,18 +27197,30 @@ "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "action", "created_at", - "actor", - "operation_type", - "actor_id", - "user_id", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam" }, @@ -18058,18 +27229,30 @@ "description": "A user reset their account password.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "@timestamp", - "_document_id", - "actor", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -18077,16 +27260,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_id", - "action", "@timestamp", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -18097,16 +27293,28 @@ "fields": [ "@timestamp", "_document_id", - "request_id", - "user_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor_id", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -18115,18 +27323,30 @@ "description": "A user signed in from an unrecognized device.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "action", + "@timestamp", "_document_id", - "user_agent", - "user", - "user_id", - "operation_type", - "created_at", + "action", "actor", "actor_id", - "@timestamp", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -18134,18 +27354,30 @@ "description": "A user signed in from an unrecognized device and location.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "created_at", - "_document_id", - "request_id", - "action", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -18153,18 +27385,30 @@ "description": "A user signed in from an unrecognized location.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "action", - "operation_type", - "user_agent", - "user", + "@timestamp", "_document_id", + "action", "actor", - "created_at", "actor_id", - "@timestamp", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -18172,22 +27416,33 @@ "description": "Triggered when you clear the status on your profile.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "message", - "user", - "actor_id", "created_at", - "request_id", "limited_availability", - "action", "emoji", - "operation_type", - "user_agent", - "@timestamp", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -18195,23 +27450,33 @@ "description": "Triggered when you set or change the status on your profile.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", "fields": [ - "limited_availability", - "user", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "message", - "user_id", - "created_at", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "limited_availability", + "message", + "created_at", "emoji", - "org", - "actor", - "operation_type", - "token_scopes", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Personalize your profile" }, @@ -18220,21 +27485,31 @@ "description": "A user account was suspended.", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", - "operation_type", - "actor_id", - "user", - "user_agent", - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", - "user_id", + "_document_id", "action", - "token_scopes", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -18242,18 +27517,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", - "actor_id", "@timestamp", - "operation_type", "_document_id", - "user_agent", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -18261,18 +27548,30 @@ "description": "A 2FA challenge issued for a user account failed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "_document_id", - "user_agent", - "user", - "actor_id", - "actor", - "user_id", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -18282,16 +27581,28 @@ "fields": [ "@timestamp", "_document_id", - "user_id", - "operation_type", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "actor", + "user_id", "user_agent", - "request_id", - "action", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -18299,18 +27610,30 @@ "description": "A user used their 2FA recovery codes.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "user_agent", - "request_id", - "user", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "created_at", - "@timestamp", - "_document_id", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -18318,18 +27641,30 @@ "description": "A user downloaded 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -18337,17 +27672,30 @@ "description": "A user printed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", - "user_agent", - "request_id", - "user_id", - "created_at", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -18355,18 +27703,30 @@ "description": "A user viewed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_agent", - "actor", - "user_id", - "action", - "created_at", - "user", - "operation_type", "@timestamp", - "request_id", "_document_id", - "request_access_security_header" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -18374,17 +27734,30 @@ "description": "A user was prompted for a two-factor authentication code.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", "fields": [ - "user", - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "actor" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" }, @@ -18393,19 +27766,31 @@ "description": "A user was unblocked by another user.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "actor", - "@timestamp", - "user_agent", - "user_id", - "user", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -18414,15 +27799,28 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user_agent", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "request_id", - "actor", - "action", "created_at" ] }, @@ -18431,21 +27829,31 @@ "description": "A user account was unsuspended.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", - "user", "action", - "user_agent", "actor", - "oauth_application_id", - "operation_type", "actor_id", - "created_at", - "@timestamp", - "user_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -18453,21 +27861,33 @@ "description": "A user secret for Codespaces was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -18475,18 +27895,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -18494,16 +27926,30 @@ "description": "A Dependabot rule was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -18513,16 +27959,30 @@ "description": "A Dependabot rule was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -18532,18 +27992,31 @@ "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -18553,21 +28026,33 @@ "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -18575,21 +28060,32 @@ "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -18597,21 +28093,32 @@ "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -18619,16 +28126,30 @@ "description": "A Dependabot rule's conditions, actions, or metadata changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -18638,27 +28159,33 @@ "description": "A workflow job was approved.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", - "repo", - "repo_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -18667,23 +28194,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -18691,10 +28228,28 @@ "description": "A workflow run was cancelled.", "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -18705,20 +28260,9 @@ "run_number", "cancelled_at", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Canceling a workflow run" }, @@ -18727,23 +28271,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -18753,10 +28305,28 @@ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -18768,19 +28338,9 @@ "conclusion", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -18791,10 +28351,28 @@ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -18803,21 +28381,10 @@ "head_branch", "head_sha", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "public_repo", - "programmatic_access_type", "actor_is_bot", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "Understanding GitHub Actions" @@ -18827,23 +28394,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -18852,22 +28431,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -18875,21 +28465,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -18897,25 +28498,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -18923,23 +28532,36 @@ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", "fields": [ - "repo_id", - "repo", - "org_id", - "org", - "business_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "job_name", "runner_labels", "is_hosted_runner", "environment_name", "secrets_passed", - "action", - "_document_id", "operation_type", "created_at", - "@timestamp", "runner_owner_type", "job_workflow_ref", "calling_workflow_refs", @@ -18953,24 +28575,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -18979,10 +28610,28 @@ "description": "A workflow run was re-run.", "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -18992,21 +28641,11 @@ "head_sha", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", "rerun_type", "check_run_id", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "Re-running workflows and jobs" @@ -19016,25 +28655,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.19/organization.json b/src/audit-logs/data/ghes-3.19/organization.json index e0d869d05dba..76c4dd8d3706 100644 --- a/src/audit-logs/data/ghes-3.19/organization.json +++ b/src/audit-logs/data/ghes-3.19/organization.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,29 +67,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -72,21 +103,32 @@ "description": "Credit was accepted for a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Editing a repository security advisory" }, @@ -95,21 +137,32 @@ "description": "Someone was added to the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -117,21 +170,32 @@ "description": "Credit was declined for a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -140,21 +204,32 @@ "description": "Someone was removed from the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -163,18 +238,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -182,17 +269,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -203,43 +301,66 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" - }, + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + }, { "action": "billing.budget_create", "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -255,22 +376,34 @@ "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "uuid", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -278,25 +411,37 @@ "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", - "request_access_security_header", "old_target_amount", "old_budget_limit_type", "old_alert_enabled", @@ -310,17 +455,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -329,19 +487,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -350,15 +520,28 @@ "description": "Azure subscription has been linked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -368,15 +551,28 @@ "description": "Azure subscription has been unlinked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -386,18 +582,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -405,18 +614,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -424,20 +645,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -446,20 +678,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -470,17 +713,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -488,15 +743,31 @@ "description": "Existing code scanning alerts appeared in a branch.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -506,15 +777,31 @@ "description": "Code scanning alerts were fixed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -524,15 +811,31 @@ "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_numbers", "commit_oid", - "ref", - "request_id", - "org_id", - "org", - "business_id", - "business" + "ref" ], "docs_reference_titles": "About code scanning" }, @@ -541,15 +844,29 @@ "description": "Code scanning alerts were manually dismissed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers", "dismissal_approver_id" ], @@ -560,19 +877,31 @@ "description": "Dismissal of code scanning alerts was approved.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -583,19 +912,31 @@ "description": "Dismissal of code scanning alerts was denied.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -606,19 +947,31 @@ "description": "Dismissal of code scanning alerts was requested.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -629,13 +982,31 @@ "description": "Code scanning alerts were seen for the first time.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "commit_oid", - "ref", - "request_id", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", + "commit_oid", + "ref", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -645,15 +1016,31 @@ "description": "Code scanning alerts that were previously fixed reappeared.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -663,15 +1050,29 @@ "description": "Code scanning alerts that were previously dismissed were reopened.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -681,14 +1082,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -698,28 +1114,34 @@ "description": "An attempt to create a codespace from a prebuild was made.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "owner", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "user_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_id", + "user_agent", + "name", + "owner", + "pull_request_id", "created_at", "operation_type", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -727,17 +1149,30 @@ "description": "Enterprise setting for Codespaces ownership was updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enablement", "organization_names", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -748,25 +1183,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -777,22 +1221,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -804,22 +1259,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -828,15 +1294,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "owner", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "owner", "created_at", "operation_type", "public_repo" @@ -847,15 +1328,28 @@ "description": "Policies were applied to codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -865,20 +1359,30 @@ "description": "Policies were removed from codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -886,19 +1390,30 @@ "description": "Policies were updated for codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -906,17 +1421,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -926,27 +1454,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "org", "owner", "pull_request_id", "machine_type", - "user_id", - "user", "devcontainer_path", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -954,19 +1491,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -974,18 +1524,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -994,20 +1556,30 @@ "description": "A commit comment was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "repo", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "created_at", - "@timestamp", - "operation_type", + "programmatic_access_type", + "repo", "repo_id", - "actor_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "programmatic_access_type" + "created_at", + "operation_type" ] }, { @@ -1015,43 +1587,64 @@ "description": "A commit comment was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "repo_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_id", - "action", - "@timestamp", - "repo", "org_id", - "actor_id", - "created_at", - "user_agent", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" - ] - }, - { - "action": "copilot.access_revoked", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "copilot.access_revoked", "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "reason", "plan", - "org_id", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1059,13 +1652,28 @@ "description": "Copilot feature settings were changed at the organization level.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1075,23 +1683,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -1099,16 +1714,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -1117,24 +1746,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -1142,15 +1777,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1160,20 +1808,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -1181,19 +1839,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -1201,21 +1871,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1223,21 +1902,33 @@ "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_value", - "new_value", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_value", + "new_value", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1245,21 +1936,32 @@ "description": "The excluded paths for GitHub Copilot were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "excluded_paths", "owner_type", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1267,14 +1969,28 @@ "description": "Copilot custom instructions were created for the organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "action", - "_document_id", - "@timestamp", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "custom_instructions" @@ -1285,14 +2001,28 @@ "description": "Copilot custom instructions were updated for the organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "action", - "_document_id", - "@timestamp", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "custom_instructions" @@ -1303,21 +2033,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1325,21 +2065,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1347,21 +2097,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1369,17 +2129,30 @@ "description": "The plan for GitHub Copilot was updated.", "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_plan", "plan", - "business_id", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1391,20 +2164,31 @@ "description": "The plan for GitHub Copilot was scheduled to be downgraded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "current_plan", "scheduled_plan" @@ -1415,18 +2199,30 @@ "description": "MCP Configuration for Copilot coding agent was updated for a specific repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "new_config", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "new_config", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1436,22 +2232,33 @@ "description": "Specific repositories were disabled from using Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "owner_type", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1459,21 +2266,31 @@ "description": "Specific repositories were enabled to use Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "owner_type", - "owner", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1483,20 +2300,32 @@ "description": "Copilot coding agent access was updated for the organization's or user's repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_access", "old_access", - "org_id", "owner_type", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1506,21 +2335,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1530,19 +2368,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1552,21 +2399,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1576,18 +2432,31 @@ "description": "A new custom property definition was created.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -1600,18 +2469,31 @@ "description": "A custom property definition was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -1625,14 +2507,29 @@ "description": "A custom property definition was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "value_type", @@ -1645,8 +2542,7 @@ "old_default_value", "old_value_type", "old_values_editable_by", - "values_editable_by", - "request_access_security_header" + "values_editable_by" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1655,27 +2551,35 @@ "description": "A repository's custom property value was manually set for the first time.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "definition_id", - "property_name", - "value", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "definition_id", + "property_name", + "value", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1684,19 +2588,31 @@ "description": "A repository's custom property value was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1705,16 +2621,29 @@ "description": "A repository's custom property value was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "definition_id" @@ -1726,19 +2655,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1747,19 +2687,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1768,19 +2719,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1789,19 +2751,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1810,21 +2783,31 @@ "description": "The default repository access for Dependabot was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "access_level", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -1833,17 +2816,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1851,19 +2847,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1872,19 +2879,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1892,19 +2910,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1913,19 +2942,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1933,19 +2973,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1954,19 +3005,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1974,19 +3036,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1995,20 +3068,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2016,21 +3099,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", - "repo_id", - "request_id", + "@timestamp", + "_document_id", "action", "actor", - "org_id", - "_document_id", "actor_id", - "operation_type", - "@timestamp", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2038,43 +3130,62 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo_id", "@timestamp", - "actor", - "user_agent", - "request_id", - "org", "_document_id", - "actor_id", - "operation_type", - "created_at", - "repo", - "org_id", "action", - "request_access_security_header" - ] - }, - { - "action": "discussion.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "repo_id", - "user_agent", - "actor_id", - "org_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "title", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "discussion.destroy", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", "_document_id", - "created_at", - "repo", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "title", + "created_at" ] }, { @@ -2082,21 +3193,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "team", - "created_at", - "user_id", "@timestamp", - "number", - "org", - "title", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", "user_agent", - "operation_type", - "_document_id" + "team", + "created_at", + "number", + "title", + "operation_type" ] }, { @@ -2104,18 +3227,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user_id", - "actor", "number", - "user", - "created_at", - "request_id", - "_document_id" + "created_at" ] }, { @@ -2123,18 +3259,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "action", - "_document_id", - "request_id", - "org", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org_id", "user_agent", - "actor", + "operation_type", "number", "team", "created_at" @@ -2145,21 +3292,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "_document_id", - "title", - "user", - "user_agent", - "org", - "operation_type", - "actor_id", "@timestamp", - "actor", - "team", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", + "title", + "operation_type", + "team", "number" ] }, @@ -2168,17 +3326,31 @@ "description": "A global announcement banner was created for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2189,16 +3361,30 @@ "description": "A global announcement banner was removed from the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2209,18 +3395,32 @@ "description": "A global announcement banner was updated for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", "old_message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2231,17 +3431,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was created.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", - "operation_type", "@timestamp", "_document_id", - "org_id", "action", - "request_id", - "org", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -2250,17 +3463,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was deleted.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", + "@timestamp", "_document_id", "action", - "@timestamp", - "actor_id", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -2269,22 +3495,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2293,22 +3528,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2316,28 +3561,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2346,27 +3597,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -2375,25 +3634,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2402,26 +3669,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2430,21 +3704,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -2453,22 +3739,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2477,25 +3773,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2504,22 +3809,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -2528,21 +3845,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -2553,19 +3880,30 @@ "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2574,20 +3912,30 @@ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2596,19 +3944,30 @@ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2617,23 +3976,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2641,18 +4009,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -2663,48 +4041,68 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type" - ] - }, - { - "action": "hook.active_changed", - "description": "A hook's active status was updated.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", + "created_at", + "operation_type" + ] + }, + { + "action": "hook.active_changed", + "description": "A hook's active status was updated.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -2712,25 +4110,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -2738,26 +4145,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -2766,25 +4182,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -2792,26 +4217,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -2819,21 +4253,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -2842,19 +4287,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -2862,42 +4320,67 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "application_client_id" - ] - }, - { - "action": "integration_installation.create", - "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", - "fields": [ + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", "operation_type", + "created_at", + "application_client_id" + ] + }, + { + "action": "integration_installation.create", + "description": "A GitHub App was installed.", + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -2908,20 +4391,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2931,24 +4426,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2959,23 +4465,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2986,21 +4504,33 @@ "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", "operation_type", - "@timestamp", "integration", - "action", - "user_agent", "reason", - "_document_id", - "org", - "org_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -3011,20 +4541,32 @@ "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ "@timestamp", - "actor_id", - "org", "_document_id", - "requester", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "requester", "created_at", "url", - "org_id", - "request_id", "operation_type", - "actor", "integration", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -3034,20 +4576,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -3057,19 +4612,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -3078,20 +4647,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", - "user_id", - "user_agent", - "name", - "user", - "operation_type", - "actor_id", - "action", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "integration", + "name", + "operation_type", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -3101,20 +4683,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -3123,20 +4718,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -3145,20 +4753,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -3166,19 +4786,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -3187,19 +4820,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -3208,17 +4854,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -3231,21 +4890,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -3259,17 +4931,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -3281,39 +4966,61 @@ "description": "An IP allow list was disabled.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "actor", - "request_id", - "org", - "user_agent", + "@timestamp", "_document_id", - "user_id", - "actor_id", - "created_at", - "org_id", "action", - "@timestamp", - "user" - ] + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] }, { "action": "ip_allow_list.disable_for_installed_apps", "description": "An IP allow list was disabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3321,20 +5028,29 @@ "description": "An IP allow list was enabled.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "user_id", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "business_id", - "_document_id", - "action", - "@timestamp", + "user_id", "user_agent", - "actor_id", "operation_type", - "org", "created_at" ] }, @@ -3343,19 +5059,30 @@ "description": "An IP allow list was enabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3363,24 +5090,32 @@ "description": "An IP address was added to an IP allow list.", "docs_reference_links": "N/A", "fields": [ - "active", - "org", - "ip_allow_list_entry", "@timestamp", "_document_id", - "operation_type", - "created_at", - "user_agent", "action", - "request_id", + "actor", "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "business", - "actor", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", + "ip_allow_list_entry", + "operation_type", + "created_at" ] }, { @@ -3388,24 +5123,32 @@ "description": "An IP address was deleted from an IP allow list.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "ip_allow_list_entry", - "org", - "operation_type", - "created_at", - "active", "action", - "@timestamp", + "actor", + "actor_id", "business", "business_id", - "user_agent", + "hashed_token", + "org", "org_id", - "actor", - "actor_id", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ip_allow_list_entry", + "operation_type", + "created_at", + "active" ] }, { @@ -3413,19 +5156,32 @@ "description": "An IP address or its description was changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "actor_id", "ip_allow_list_entry", - "active", - "org_id", - "@timestamp" + "active" ] }, { @@ -3433,22 +5189,31 @@ "description": "A comment on an issue was deleted from the repository.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "org", - "repo", - "actor_id", "@timestamp", - "created_at", "_document_id", "action", - "operation_type", - "user_agent", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "oauth_application_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -3456,24 +5221,30 @@ "description": "A comment on an issue was pinned to a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3484,19 +5255,29 @@ "description": "A comment on an issue was unpinned from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "public_repo", "created_at", "operation_type", "actor_is_bot" @@ -3507,22 +5288,31 @@ "description": "A comment on an issue (other than the initial one) changed.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", - "action", - "repo_id", - "org_id", - "created_at", - "operation_type", "@timestamp", - "user_agent", - "request_id", "_document_id", - "actor_id", + "action", "actor", - "oauth_application_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -3530,20 +5320,30 @@ "description": "An issue was marked as blocked by another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3554,19 +5354,30 @@ "description": "The blocked by relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3576,20 +5387,30 @@ "description": "An issue was marked as blocking another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3600,20 +5421,30 @@ "description": "The blocking relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3624,21 +5455,31 @@ "description": "An issue was deleted from the repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", "fields": [ - "user", - "actor_id", - "created_at", - "title", "@timestamp", "_document_id", - "request_id", - "actor", - "user_id", "action", - "operation_type", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "title", + "operation_type" ], "docs_reference_titles": "Deleting an issue" }, @@ -3647,23 +5488,33 @@ "description": "An issue was pinned to a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ + "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", "action", "actor", - "operation_type", - "owner_type", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "number", - "repo", - "event", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type", + "owner_type", + "number", + "event" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -3672,22 +5523,32 @@ "description": "An issue was transferred to another repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "owner_type", - "actor_id", "number", - "repo", "operation_type", - "_document_id", - "repo_id", - "action", - "request_id", - "created_at", - "actor", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Transferring an issue to another repository" }, @@ -3696,20 +5557,32 @@ "description": "An issue type was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "issue_type_name", - "description", - "color", - "enabled", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "issue_type_name", + "description", + "color", + "enabled", "created_at", "operation_type", "actor_is_bot" @@ -3720,20 +5593,32 @@ "description": "An issue type was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issue_type_name", "description", "color", "enabled", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3744,11 +5629,28 @@ "description": "An issue type was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issue_type_name", "description", "color", @@ -3757,11 +5659,6 @@ "old_description", "old_color", "old_enabled", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3772,24 +5669,33 @@ "description": "An issue was unpinned from a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ - "event", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", - "action", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "operation_type", - "_document_id", - "number", - "owner_type", - "@timestamp", + "token_id", + "token_scopes", "user", "user_id", - "token_scopes", - "request_access_security_header" + "user_agent", + "event", + "created_at", + "operation_type", + "number", + "owner_type" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -3798,19 +5704,30 @@ "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user_agent", - "action", "@timestamp", - "operation_type", - "request_id", - "actor_id", - "user_id", - "created_at", "_document_id", + "action", "actor", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "org_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3819,18 +5736,29 @@ "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -3840,19 +5768,30 @@ "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user", - "request_id", - "actor", - "business_id", - "action", - "operation_type", - "user_agent", - "created_at", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor_id" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3861,18 +5800,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3880,21 +5831,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -3902,44 +5866,70 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", - "org", - "secondary_category", - "operation_type", - "created_at", + "actor", "actor_id", - "_document_id" - ] - }, + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", + "secondary_category", + "operation_type", + "created_at" + ] + }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -3947,19 +5937,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -3969,22 +5972,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -3992,22 +6008,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -4015,20 +6044,30 @@ "description": "The ability for members to publish GitHub Pages sites was disabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4037,20 +6076,30 @@ "description": "The ability for members to publish GitHub Pages sites was enabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4059,21 +6108,30 @@ "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4082,22 +6140,30 @@ "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4106,21 +6172,30 @@ "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4129,22 +6204,30 @@ "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4153,19 +6236,30 @@ "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "operation_type", "user_agent", - "actor", - "actor_id", - "business_id", - "@timestamp", - "created_at", - "action" + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -4174,18 +6268,29 @@ "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "request_id", - "org", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "actor", "operation_type", - "org_id", - "action", - "@timestamp", "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -4195,21 +6300,30 @@ "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "action", - "org_id", - "user_id", - "business", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business_id", + "user_id", + "user_agent", "created_at", - "actor", - "org", - "operation_type", - "user_agent" + "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -4220,16 +6334,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -4238,21 +6363,30 @@ "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "created_at", - "user_id", "business_id", - "user", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "org_id", - "@timestamp" + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -4261,19 +6395,30 @@ "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ - "request_id", - "created_at", - "_document_id", - "user_agent", - "user", - "user_id", - "business", - "business_id", - "operation_type", "@timestamp", + "_document_id", "action", "actor", - "actor_id" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -4282,19 +6427,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4302,21 +6459,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", - "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "public_repo", "created_at", "operation_type" ] @@ -4326,16 +6492,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4345,18 +6524,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4366,14 +6558,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -4381,19 +6589,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -4401,18 +6620,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -4420,23 +6651,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -4444,16 +6683,30 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "org_id", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4461,24 +6714,32 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", - "repo_id", "operation_type", - "@timestamp", - "user_agent", "created_at", - "org", - "action", - "_document_id", - "repo", - "actor", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4486,15 +6747,28 @@ "description": "A network configuration for a hosted compute service was created.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -4512,18 +6786,31 @@ "description": "A network configuration for a hosted compute service was deleted.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "actor_is_bot", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot", "network_configuration_id" ], "docs_reference_titles": "About networking for hosted compute products in your enterprise" @@ -4533,15 +6820,28 @@ "description": "A network configuration for a hosted compute service was updated.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -4558,20 +6858,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4580,20 +6892,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4602,20 +6926,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4624,20 +6960,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4646,19 +6994,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4667,20 +7028,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4689,20 +7062,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4711,38 +7096,62 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", - "request_id", - "user", - "action" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "org.accept_business_invitation", - "description": "An invitation sent to an organization to join an enterprise was accepted.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", - "fields": [ - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" + ], + "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + }, + { + "action": "org.accept_business_invitation", + "description": "An invitation sent to an organization to join an enterprise was accepted.", + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4753,20 +7162,30 @@ "description": "A billing manager was added to an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "org", - "user_id", "action", - "created_at", - "org_id", - "user", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" }, @@ -4775,19 +7194,29 @@ "description": "An organization prevented access to resources by users with the given two-factor method.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "two_factor_method", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "two_factor_method", "created_at", "operation_type", "actor_is_bot" @@ -4798,21 +7227,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -4821,24 +7260,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4846,21 +7295,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -4868,20 +7327,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -4889,22 +7358,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -4912,20 +7389,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4933,22 +7420,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -4956,21 +7451,31 @@ "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "new_policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "new_policy", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -4980,19 +7485,30 @@ "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -5001,19 +7517,30 @@ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -5023,15 +7550,28 @@ "description": "Third-party application access for outside collaborators was disabled for the organization.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5042,15 +7582,28 @@ "description": "Third-party application access for outside collaborators was enabled for the organization.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5061,15 +7614,28 @@ "description": "The organization was archived.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5079,17 +7645,30 @@ "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", "fields": [ - "org_id", - "operation_type", "@timestamp", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" }, @@ -5098,21 +7677,32 @@ "description": "An export of the organization's Git events was created.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "start", "end", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" }, @@ -5121,16 +7711,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_agent", - "action", "@timestamp", - "actor_id", - "org_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -5139,18 +7742,31 @@ "description": "An organization owner blocked a user from accessing the organization's repositories.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", "fields": [ - "actor", - "user_agent", - "org_id", - "created_at", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "blocked_user", + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" }, @@ -5159,19 +7775,30 @@ "description": "An invitation for an organization to join an enterprise was revoked", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "initiated_from" ], "docs_reference_titles": "Adding organizations to your enterprise" @@ -5181,22 +7808,33 @@ "description": "An invitation sent to a user to join an organization was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "email", - "@timestamp", - "actor", - "action", "operation_type", - "user_agent", - "org", "invitation_id", - "_document_id", "created_at", - "invitee_email", - "token_scopes", - "programmatic_access_type" + "invitee_email" ] }, { @@ -5204,19 +7842,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -5224,16 +7873,28 @@ "description": "Cleared two-factor authentication restrictions for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -5244,23 +7905,31 @@ "description": "Autofix for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5268,21 +7937,31 @@ "description": "Autofix for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5290,23 +7969,31 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5314,23 +8001,31 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5338,10 +8033,28 @@ "description": "Enablement for Code Security features on new repositories has been locked for this organization.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "action", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5351,10 +8064,28 @@ "description": "Enablement for Code Security features on new repositories has been unlocked for this organization.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "action", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5364,21 +8095,30 @@ "description": "Code scanning using the default setup was disabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -5387,21 +8127,30 @@ "description": "Code scanning using the default setup was enabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -5410,20 +8159,31 @@ "description": "Access to use Codespaces on internal and private repositories was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "enablement", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "enablement", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization" }, @@ -5432,21 +8192,31 @@ "description": "Ownership and payment for codespaces was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "owner_type", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" }, @@ -5455,16 +8225,29 @@ "description": "A team has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5474,16 +8257,29 @@ "description": "A team has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5493,19 +8289,30 @@ "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -5514,17 +8321,30 @@ "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -5533,21 +8353,30 @@ "description": "A user has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -5555,21 +8384,30 @@ "description": "A user has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -5577,16 +8415,29 @@ "description": "The interaction limit for collaborators only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "request_id", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" @@ -5596,17 +8447,30 @@ "description": "The interaction limit for prior contributors only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "operation_type", "@timestamp", - "created_at", - "user_agent", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", - "actor", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5615,17 +8479,30 @@ "description": "The interaction limit for existing users only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", "_document_id", - "operation_type", - "actor_id", - "org_id", "action", - "created_at", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5635,16 +8512,29 @@ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ "@timestamp", - "created_at", "_document_id", - "actor_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "action", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5653,17 +8543,30 @@ "description": "The interaction limit for prior contributors only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "operation_type", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5672,17 +8575,30 @@ "description": "The interaction limit for existing users only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "actor_id", - "request_id", + "@timestamp", + "_document_id", "action", - "created_at", - "user_agent", "actor", - "_document_id", - "org_id", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5691,22 +8607,30 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" }, @@ -5715,17 +8639,28 @@ "description": "An invitation for an organization to join an enterprise was confirmed.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5736,15 +8671,28 @@ "description": "Server statistics were exported for the organization.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5755,18 +8703,30 @@ "description": "An organization was created.", "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", "fields": [ - "request_id", - "org", - "actor_id", - "actor", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "org_id", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" }, @@ -5775,20 +8735,31 @@ "description": "A GitHub Actions secret was created for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5797,20 +8768,32 @@ "description": "A GitHub Actions variable was created for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5819,21 +8802,33 @@ "description": "A Codespaces or Dependabot secret was created for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -5841,21 +8836,30 @@ "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor_id", - "org_id", - "business", - "action", "@timestamp", - "org", "_document_id", - "business_id", + "action", "actor", - "token_scopes", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "actor_is_bot", "oauth_credential_type", "managed_oauth_access_id", @@ -5871,24 +8875,32 @@ "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", "fields": [ - "user_agent", - "actor", "@timestamp", - "created_at", - "org_id", - "business_id", - "operation_type", - "request_id", "_document_id", "action", + "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", - "token_scopes", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot", "oauth_credential_type", - "request_access_security_header", "managed_oauth_access_id", "managed_token_id", "managed_oauth_scopes", @@ -5902,21 +8914,32 @@ "description": "An owner revoked authorized credentials.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "oauth_application_id", - "org_id", "operation_type", - "action", - "business", - "request_id", "created_at", - "business_id", - "actor_id", - "_document_id", - "user_agent", "oauth_credential_type", "managed_oauth_access_id", "managed_token_id", @@ -5931,18 +8954,30 @@ "description": "An organization was deleted by a user or staff.", "docs_reference_links": "N/A", "fields": [ - "user_agent", "@timestamp", "_document_id", - "created_at", - "actor", - "org_id", - "org", "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5950,38 +8985,61 @@ "description": "Team creation was limited to owners.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "actor", "@timestamp", "_document_id", - "user", - "user_id", "action", - "created_at", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" - }, - { + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + }, + { "action": "org.disable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were disabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "org_id", - "action", - "_document_id", - "request_id", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" @@ -5991,19 +9049,30 @@ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -6012,14 +9081,31 @@ "description": "SAML single sign-on was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sso_url", "issuer", - "action", - "@timestamp", - "_document_id", "created_at", - "org", "operation_type" ] }, @@ -6028,21 +9114,30 @@ "description": "Display of IP addresses within audit log events for the organization was disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" }, @@ -6051,17 +9146,30 @@ "description": "A two-factor authentication requirement was disabled for the organization.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "org_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "_document_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6069,19 +9177,30 @@ "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "user", - "action", - "operation_type", "@timestamp", "_document_id", - "created_at", - "user_agent", - "org", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6089,19 +9208,30 @@ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "user", - "action", - "actor_id", - "org_id" + "created_at" ] }, { @@ -6109,19 +9239,30 @@ "description": "Team creation by members was allowed.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "org_id", - "user", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -6130,17 +9271,30 @@ "description": "Third-party application access restrictions for an organization were enabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "operation_type", - "org", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" }, @@ -6149,19 +9303,30 @@ "description": "An organization owner allowed users with read access to create discussions in an organization", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user", - "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -6170,19 +9335,32 @@ "description": "SAML single sign-on was enabled for the organization.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", - "sso_url", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "@timestamp", - "issuer", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "sso_url", + "created_at", + "issuer" ], "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" }, @@ -6191,21 +9369,30 @@ "description": "Display of IP addresses within audit log events for the organization was enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" }, @@ -6214,17 +9401,30 @@ "description": "Two-factor authentication is now required for the organization.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "actor_id", - "action", - "_document_id", - "org", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" }, @@ -6233,17 +9433,30 @@ "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "org_id", - "manager", "@timestamp", - "request_id", - "actor", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "manager", + "operation_type", "created_at" ] }, @@ -6252,18 +9465,31 @@ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", "docs_reference_links": "N/A", "fields": [ - "org_id", "@timestamp", - "org", - "user_agent", - "request_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "manager", "operation_type", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6271,23 +9497,32 @@ "description": "A new user was invited to join an organization.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", "fields": [ - "org", - "user_id", - "invitation_id", - "org_id", - "user", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", - "created_at", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "invitee_email", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitation_id", + "operation_type", + "created_at", + "invitee_email" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" }, @@ -6296,17 +9531,28 @@ "description": "An organization was invited to join an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -6316,19 +9562,30 @@ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6336,19 +9593,30 @@ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "org", - "org_id", - "user_agent", - "actor_id", - "user_id", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6356,19 +9624,31 @@ "description": "Access to an organization was granted for an OAuth App.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "request_id", "actor_id", - "operation_type", - "org_id", - "_document_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" @@ -6378,20 +9658,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -6400,18 +9691,31 @@ "description": "Access was disabled for an OAuth App that was previously approved.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", "fields": [ - "request_id", - "url", - "created_at", - "org_id", - "action", "@timestamp", "_document_id", - "user_agent", - "org", - "operation_type", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", + "operation_type", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" @@ -6421,19 +9725,31 @@ "description": "An organization member requested that an owner grant an OAuth App access to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", + "@timestamp", "_document_id", - "request_id", - "url", - "org_id", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "url", "oauth_application_name" ] }, @@ -6442,20 +9758,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -6465,16 +9792,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "org_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type", - "_document_id", - "org" + "created_at", + "operation_type" ] }, { @@ -6482,20 +9822,31 @@ "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "reason", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "reason", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -6504,20 +9855,30 @@ "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -6526,19 +9887,30 @@ "description": "An organization owner downloaded the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6547,19 +9919,30 @@ "description": "An organization owner generated the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "business", - "business_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6568,19 +9951,30 @@ "description": "An organization owner printed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6589,19 +9983,30 @@ "description": "An organization owner viewed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6610,19 +10015,31 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", "fields": [ - "actor", - "operation_type", "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "actor_is_bot", - "request_access_security_header" + "operation_type", + "created_at", + "actor_is_bot" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -6631,20 +10048,31 @@ "description": "A GitHub Actions secret was removed from an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -6653,21 +10081,31 @@ "description": "A GitHub Actions variable was removed from an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -6676,18 +10114,29 @@ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "user_id", - "user_agent", - "org_id", - "user", - "action", - "_document_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" @@ -6697,19 +10146,29 @@ "description": "Removed a two-factor authentication method restriction for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "two_factor_method", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "two_factor_method", "created_at", "operation_type", "actor_is_bot" @@ -6720,22 +10179,32 @@ "description": "A Codespaces or Dependabot secret was removed from an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -6743,43 +10212,61 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "token_scopes", - "programmatic_access_type" - ] - }, - { - "action": "org.remove_outside_collaborator", - "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A", - "fields": [ - "org", - "user", "org_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "action", - "operation_type", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "org.remove_outside_collaborator", + "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6787,21 +10274,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -6809,18 +10306,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", "fields": [ - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "actor", - "action", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -6829,19 +10338,31 @@ "description": "An organization was renamed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "_document_id", "@timestamp", - "org", + "_document_id", "action", "actor", - "old_login", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_login", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -6849,14 +10370,28 @@ "description": "Triggered when a required workflow is created.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6867,14 +10402,28 @@ "description": "Triggered when a required workflow is deleted.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6885,14 +10434,28 @@ "description": "Triggered when a required workflow is updated.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6903,20 +10466,30 @@ "description": "An organization member was restored.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", "fields": [ - "user", - "actor", - "user_id", + "@timestamp", "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "actor_id", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" }, @@ -6925,18 +10498,29 @@ "description": "A member's linked identity was revoked.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", "user_id", - "@timestamp", - "action", - "actor_id", "user_agent", - "_document_id", - "request_id", + "operation_type", "created_at" ], "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" @@ -6946,19 +10530,30 @@ "description": "A member's SAML session was revoked.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", "fields": [ - "actor_id", - "created_at", - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" }, @@ -6967,21 +10562,33 @@ "description": "A self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" @@ -6991,21 +10598,31 @@ "description": "A self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7014,20 +10631,31 @@ "description": "A self-hosted runner group was renamed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7036,23 +10664,33 @@ "description": "The REST API was used to remove a self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -7061,23 +10699,31 @@ "description": "A self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7086,19 +10732,32 @@ "description": "A runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -7107,25 +10766,36 @@ "description": "The configuration of a self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7134,21 +10804,32 @@ "description": "The visibility of a self-hosted runner group was updated via the REST API.", "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", - "visibility", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" }, @@ -7157,10 +10838,28 @@ "description": "Enablement for Secret Protection features on new repositories has been locked for this organization.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "action", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7170,10 +10869,28 @@ "description": "Enablement for Secret Protection features on new repositories has been unlocked for this organization.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "action", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7183,21 +10900,30 @@ "description": "Automatic partner validation checks have been disabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -7207,21 +10933,30 @@ "description": "Automatic partner validation checks have been enabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -7231,20 +10966,30 @@ "description": "A custom pattern was created for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7253,22 +10998,30 @@ "description": "A custom pattern was removed from secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7277,21 +11030,30 @@ "description": "A custom pattern was published for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7300,21 +11062,30 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7323,22 +11094,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7347,21 +11126,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7370,22 +11158,30 @@ "description": "Generic secrets have been disabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -7393,22 +11189,30 @@ "description": "Generic secrets have been enabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -7416,21 +11220,30 @@ "description": "Secret scanning for non-provider patterns was disabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7440,21 +11253,30 @@ "description": "Secret scanning for non-provider patterns was enabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7464,19 +11286,30 @@ "description": "A role or team was added to the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7486,21 +11319,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7510,21 +11352,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7534,19 +11385,30 @@ "description": "A role or team was removed from the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7556,22 +11418,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7580,46 +11450,62 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "programmatic_access_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org.secret_scanning_push_protection_custom_message_updated", - "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "About push protection" + }, + { + "action": "org.secret_scanning_push_protection_custom_message_updated", + "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7628,21 +11514,30 @@ "description": "Push protection for secret scanning was disabled.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7651,21 +11546,30 @@ "description": "Push protection for secret scanning was enabled.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7674,22 +11578,30 @@ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7698,22 +11610,30 @@ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7722,12 +11642,28 @@ "description": "The push protection setting was updated for a secret type for your organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "push_protection_setting", "secret_type", "secret_type_display_name", @@ -7740,12 +11676,28 @@ "description": "The push protection pattern configuration was updated for your organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at" ], "docs_reference_titles": "About push protection" @@ -7755,26 +11707,35 @@ "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -7783,26 +11744,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7810,28 +11779,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7839,26 +11816,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7866,15 +11851,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -7883,15 +11885,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -7900,7 +11919,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -7915,18 +11955,28 @@ "description": "The cache retention policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -7938,18 +11988,28 @@ "description": "The cache storage policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -7961,20 +12021,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -7983,16 +12054,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -8003,18 +12087,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -8023,17 +12120,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", "_document_id", - "org_id", - "operation_type", + "action", "actor", "actor_id", - "@timestamp", - "request_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", - "action" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8041,18 +12151,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -8061,18 +12183,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -8081,18 +12216,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -8101,22 +12248,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", "actor_id", - "org_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issuer", - "business", "operation_type", "created_at", - "request_id", - "business_id", - "_document_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8124,21 +12281,32 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Adding organizations to your enterprise" }, @@ -8147,19 +12315,30 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8170,15 +12349,28 @@ "description": "The organization was unarchived.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -8188,19 +12380,32 @@ "description": "A user was unblocked from an organization.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", "fields": [ - "oauth_application_id", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", - "@timestamp", - "request_id", - "created_at", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "blocked_user", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" }, @@ -8209,45 +12414,68 @@ "description": "A GitHub Actions secret was updated for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "created_at", - "key", - "org", - "org_id", - "action", - "operation_type", "@timestamp", "_document_id", - "programmatic_access_type" - ], - "docs_reference_titles": "Using secrets in GitHub Actions" - }, - { - "action": "org.update_actions_settings", - "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", - "fields": [ - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", + "key", + "operation_type" + ], + "docs_reference_titles": "Using secrets in GitHub Actions" + }, + { + "action": "org.update_actions_settings", + "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "updated_allowed_types", "old_policy", - "updated_access_policy", - "programmatic_access_type", - "request_access_security_header" + "updated_access_policy" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" }, @@ -8256,20 +12484,32 @@ "description": "A GitHub Actions variable was updated for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -8278,20 +12518,32 @@ "description": "The default repository permission level for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", + "created_at", "permission", - "actor_id", - "old_permission", - "_document_id", - "programmatic_access_type" + "old_permission" ] }, { @@ -8299,18 +12551,30 @@ "description": "The settings policy for immutable releases was updated for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_policy", "new_policy", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8321,22 +12585,33 @@ "description": "A Codespaces or Dependabot secret was updated for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -8345,20 +12620,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -8366,17 +12652,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -8386,20 +12685,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -8408,36 +12718,62 @@ "description": "The name of the default branch was changed for new repositories in the organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" - }, + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" + }, { "action": "org.update_repo_self_hosted_runners_policy", "description": "The repository self-hosted runners policy was updated", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_repo_runners_policy", "new_repo_runners_policy", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8448,19 +12784,32 @@ "description": "An organization's SAML provider settings were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "sso_url", - "actor_id", - "operation_type", "@timestamp", - "issuer", - "org", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "operation_type", + "issuer", + "created_at" ] }, { @@ -8468,18 +12817,30 @@ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", "fields": [ - "request_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "_document_id", - "org", - "action", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" }, @@ -8488,21 +12849,31 @@ "description": "An organization's custom property value was manually set for the first time.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8514,21 +12885,31 @@ "description": "An organization's custom property value was deleted.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8540,18 +12921,30 @@ "description": "A default label was created for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", "fields": [ - "request_id", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", - "_document_id", - "action", - "created_at", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" }, @@ -8560,17 +12953,30 @@ "description": "A default label was deleted for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", "fields": [ - "operation_type", - "request_id", - "actor", "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" }, @@ -8579,17 +12985,30 @@ "description": "A default label was edited for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", "fields": [ - "org", - "created_at", "@timestamp", - "actor", + "_document_id", "action", - "user_agent", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" }, @@ -8598,20 +13017,33 @@ "description": "A domain was approved for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "org_id", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" }, @@ -8620,16 +13052,31 @@ "description": "A domain was added to an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "created_at", + "@timestamp", "_document_id", - "domain_name", "action", - "request_id", + "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "domain_name", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8638,14 +13085,29 @@ "description": "A domain was removed from an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", "fields": [ - "action", - "domain_name", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "domain_name", "operation_type", "created_at" ], @@ -8656,16 +13118,31 @@ "description": "A domain was verified for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "operation_type", - "domain_name", "@timestamp", - "user_agent", - "request_id", - "actor", - "action", - "created_at", "_document_id", - "actor_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "domain_name", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8674,16 +13151,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -8693,17 +13183,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -8713,16 +13214,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -8732,20 +13246,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -8753,19 +13277,30 @@ "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor", - "business_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", "user_agent", - "_document_id", "created_at", - "operation_type", - "request_id", - "business" + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -8774,19 +13309,30 @@ "description": "Organization projects were disabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "operation_type", - "@timestamp", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -8795,44 +13341,65 @@ "description": "Organization projects were enabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor_id", - "org_id", - "created_at", - "user_id", - "org", "@timestamp", "_document_id", - "user_agent", - "actor", - "request_id", - "user", "action", - "operation_type" - ], - "docs_reference_titles": "Enforcing policies for projects in your enterprise" - }, - { - "action": "organization_role.assign", - "description": "An organization role was assigned to a user or team.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", - "fields": [ "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "Enforcing policies for projects in your enterprise" + }, + { + "action": "organization_role.assign", + "description": "An organization role was assigned to a user or team.", + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About custom organization roles" }, @@ -8841,25 +13408,32 @@ "description": "A custom organization role was created in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8871,25 +13445,32 @@ "description": "A custom organization role was deleted in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8900,19 +13481,30 @@ "description": "A user or team was unassigned an organization role.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type" ], @@ -8923,26 +13515,33 @@ "description": "A custom organization role was edited in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", "old_role_permissions", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -8955,22 +13554,33 @@ "description": "An organization's default project base role was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_project_base_role", - "new_project_base_role", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_project_base_role", + "new_project_base_role", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8978,20 +13588,31 @@ "description": "An entire package was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" @@ -9001,23 +13622,34 @@ "description": "A package was published or republished to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "ecosystem", "version_count", "is_republished", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -9026,21 +13658,32 @@ "description": "A specific package version was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "version", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "ecosystem", "actor_is_bot" ], @@ -9051,21 +13694,34 @@ "description": "A specific package version was published or republished to a package.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "ecosystem", "package", "version", - "actor_id", - "user_agent", "is_republished", - "actor", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -9074,20 +13730,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -9096,17 +13766,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9117,20 +13802,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -9139,18 +13838,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9158,16 +13869,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -9175,18 +13900,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -9194,18 +13931,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9216,22 +13966,31 @@ "description": "The configured restriction for access to resources via personal access tokens was disabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9239,22 +13998,31 @@ "description": "The configured restriction for access to resources via personal access tokens was enabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "programmatic_access_type", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9262,18 +14030,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9284,18 +14065,28 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9306,18 +14097,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9328,23 +14129,34 @@ "description": "A personal access token expiration limit was set.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "token_expiration", "old_token_expiration", "exempt_administrators", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9352,21 +14164,32 @@ "description": "A personal access token expiration limit was unset.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "programmatic_access_type", - "old_token_expiration", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_token_expiration", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9374,17 +14197,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9395,18 +14231,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9418,17 +14267,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9440,20 +14302,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was created.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9465,20 +14336,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9490,20 +14370,29 @@ "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9515,20 +14404,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9540,15 +14438,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9558,17 +14471,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -9578,15 +14502,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9596,19 +14535,30 @@ "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "action", - "operation_type", "@timestamp", - "business_id", + "_document_id", + "action", + "actor", "actor_id", - "user", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9616,23 +14566,30 @@ "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "created_at", - "actor_id", + "@timestamp", "_document_id", - "actor", - "user", - "repo", "action", - "user_agent", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "request_id", - "user_id", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -9640,23 +14597,30 @@ "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_id", - "operation_type", + "@timestamp", "_document_id", "action", - "@timestamp", - "repo", - "org", - "business", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org_id", - "created_at", - "business_id" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9664,17 +14628,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9684,17 +14659,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor", - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9704,17 +14690,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9724,17 +14721,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9744,17 +14752,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -9764,17 +14785,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9782,25 +14816,36 @@ "description": "A project's base role was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_project_base_role", "new_project_base_role", "project_number", "public_project", - "business", "project_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9808,20 +14853,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -9831,25 +14887,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -9857,20 +14925,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9878,25 +14958,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9904,17 +14996,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -9922,17 +15027,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -9940,18 +15058,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -9960,18 +15090,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -9980,19 +15122,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -10000,17 +15153,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -10022,22 +15188,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -10045,19 +15220,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -10065,17 +15251,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -10083,39 +15282,62 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", - "user_agent", - "actor" - ] - }, - { - "action": "project.update_user_permission", - "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A", - "fields": [ + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", + "team" + ] + }, + { + "action": "project.update_user_permission", + "description": "A user was added to or removed from a project board or had their permission level changed.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -10123,18 +15345,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -10143,18 +15377,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -10163,16 +15409,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -10184,21 +15443,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -10206,22 +15477,32 @@ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", "fields": [ - "repo", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "name", "created_at", - "_document_id", "operation_type", - "actor", - "repo_id", - "org", - "request_id", - "actor_id", - "oauth_application_id", - "@timestamp", - "programmatic_access_type" + "oauth_application_id" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" }, @@ -10230,29 +15511,34 @@ "description": "A protected branch allowance was given to a specific user, team or integration.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "authorized_actors", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -10260,24 +15546,32 @@ "description": "Branch protection was enabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "repo_id", - "user_id", "@timestamp", - "user_agent", - "repo", - "name", - "org_id", - "user", "_document_id", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", "created_at", "authorized_actor_names", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -10288,21 +15582,31 @@ "description": "Branch protection was disabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "repo", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", - "request_id", - "repo_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "name", + "operation_type", "created_at", - "_document_id", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -10313,22 +15617,32 @@ "description": "Enforcement of dismissing stale pull requests was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "dismiss_stale_reviews_on_push", - "org_id", - "action", - "created_at", - "request_id", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismiss_stale_reviews_on_push", + "created_at", "operation_type", - "actor", - "repo", - "org", - "name", - "programmatic_access_type" + "name" ] }, { @@ -10336,24 +15650,34 @@ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "authorized_actors_only", "authorized_actors", "created_at", - "user_agent", "name", - "_document_id", - "org_id", - "request_id", - "@timestamp", - "actor_id", - "org", - "action", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -10361,30 +15685,37 @@ "description": "A branch protection requirement was overridden by a repository administrator.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "actor", "reasons", - "@timestamp", "before", "after", - "actor_id", - "repo", "operation_type", - "user_agent", "branch", "overridden_codes", - "org", - "org_id", - "action", - "_document_id", - "request_id", "referrer", - "business", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "rule_suite_id" ] @@ -10394,28 +15725,36 @@ "description": "A branch update attempt was rejected.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "request_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "branch", "before", "overridden_codes", "after", - "action", "reasons", - "actor_id", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "actor_is_bot", "rule_suite_id" @@ -10426,23 +15765,32 @@ "description": "Branch protection was enforced for repository administrators.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "admin_enforced", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "name", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "action", "repo_id", - "org_id", - "_document_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "admin_enforced", + "operation_type", + "name", + "created_at" ] }, { @@ -10450,22 +15798,32 @@ "description": "Branch deletion was enabled or disabled for a protected branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "operation_type", - "request_id", - "repo", "@timestamp", - "org_id", - "org", - "action", - "allow_deletions_enforcement_level", "_document_id", - "created_at", - "actor_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_deletions_enforcement_level", + "created_at" ] }, { @@ -10473,23 +15831,32 @@ "description": "Force pushes were enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "actor_id", - "name", + "@timestamp", "_document_id", + "action", "actor", - "repo", - "operation_type", - "request_id", - "allow_force_pushes_enforcement_level", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_force_pushes_enforcement_level", + "created_at" ] }, { @@ -10497,24 +15864,33 @@ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "ignore_approvals_from_contributors", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "ignore_approvals_from_contributors", + "public_repo", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -10523,22 +15899,32 @@ "description": "Required linear commit history was enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "operation_type", "actor", - "linear_history_requirement_enforcement_level", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "linear_history_requirement_enforcement_level", "name", - "org_id", - "repo_id", - "org", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ] }, { @@ -10546,24 +15932,33 @@ "description": "Fork syncing was enabled or disabled for a read-only branch", "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "lock_allows_fetch_and_merge", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -10572,27 +15967,34 @@ "description": "The enforcement of a branch lock was updated.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "enforcement_level", "lock_branch_enforcement_level", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -10601,18 +16003,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -10623,24 +16038,33 @@ "description": "A branch name pattern was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "old_name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "old_name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -10648,25 +16072,32 @@ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", "docs_reference_links": "N/A", "fields": [ - "name", - "org_id", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "@timestamp", + "business", "business_id", - "request_id", - "pull_request_reviews_enforcement_level", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "business", - "user_agent", - "created_at", "repo_id", - "operation_type", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "pull_request_reviews_enforcement_level", + "created_at", + "operation_type" ] }, { @@ -10674,22 +16105,32 @@ "description": "Enforcement of required code owner review was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "created_at", - "require_code_owner_review", - "operation_type", - "name", - "user_agent", - "action", "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "request_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "require_code_owner_review", + "operation_type", + "name" ] }, { @@ -10697,22 +16138,33 @@ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "require_last_push_approval", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" }, @@ -10721,22 +16173,32 @@ "description": "Enforcement of the required number of approvals before merging was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "required_approving_review_count", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "required_approving_review_count", "created_at", - "actor", "operation_type", - "user_agent", - "name", - "org_id", - "action", - "actor_id", - "_document_id", - "org", - "@timestamp", - "programmatic_access_type" + "name" ] }, { @@ -10744,25 +16206,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "user_agent", "@timestamp", "_document_id", - "name", - "repo", "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "business", - "actor_id", - "operation_type", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "required_status_checks_enforcement_level", - "org", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "required_status_checks_enforcement_level" ] }, { @@ -10770,22 +16239,32 @@ "description": "Enforcement of required commit signing was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "name", "@timestamp", - "created_at", "_document_id", - "request_id", - "repo_id", - "org", - "org_id", "action", "actor", "actor_id", - "signature_requirement_enforcement_level", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "programmatic_access_type" + "operation_type", + "name", + "created_at", + "signature_requirement_enforcement_level" ] }, { @@ -10793,22 +16272,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "created_at", - "repo_id", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "name", - "actor", - "repo", "operation_type", - "action", - "strict_required_status_checks_policy", - "programmatic_access_type" + "strict_required_status_checks_policy" ] }, { @@ -10816,23 +16305,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -10841,24 +16341,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -10867,20 +16378,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10889,21 +16414,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -10913,22 +16451,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "key", - "fingerprint", - "read_only", - "repo_id", - "operation_type", - "created_at", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "fingerprint", + "read_only", + "operation_type", + "created_at", + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10937,25 +16487,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10964,23 +16524,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", "key", "fingerprint", - "actor_id", - "actor", "title", - "user_agent", - "user_id", - "request_id", - "read_only", - "token_scopes", - "programmatic_access_type" + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10989,18 +16560,32 @@ "description": "A pull request was closed without being merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" @@ -11010,21 +16595,32 @@ "description": "A pull request was converted to a draft.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" }, @@ -11033,19 +16629,32 @@ "description": "A pull request was created.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -11056,23 +16665,35 @@ "description": "A review was requested on a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -11082,17 +16703,31 @@ "description": "A pull request was marked as in progress.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11100,19 +16735,32 @@ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -11120,19 +16768,32 @@ "description": "A pull request was merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "pull_request_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", - "pull_request_url", - "token_scopes", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", + "operation_type", + "created_at", + "pull_request_url", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" @@ -11142,21 +16803,32 @@ "description": "A pull request was marked as ready for review.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" }, @@ -11165,27 +16837,34 @@ "description": "A pull request was rebased.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "pull_request_url", "pull_request_title", - "user", - "user_id", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -11193,23 +16872,35 @@ "description": "A review request was removed from a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" }, @@ -11218,18 +16909,32 @@ "description": "A pull request was reopened after previously being closed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -11237,19 +16942,31 @@ "description": "A review comment was added to a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "comment_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -11259,20 +16976,31 @@ "description": "A review comment on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", "@timestamp", "_document_id", - "repo", - "created_at", - "request_id", - "comment_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "comment_id", + "operation_type" ] }, { @@ -11280,18 +17008,31 @@ "description": "A review comment on a pull request was changed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "request_id", - "actor_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "_document_id", - "@timestamp", - "comment_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "comment_id" ] }, { @@ -11299,21 +17040,33 @@ "description": "A review on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ] }, { @@ -11321,20 +17074,33 @@ "description": "A review on a pull request was dismissed.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", "fields": [ - "user_agent", - "request_id", - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" }, @@ -11343,19 +17109,33 @@ "description": "A review on a pull request was submitted.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" @@ -11365,22 +17145,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -11389,21 +17179,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -11412,25 +17211,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -11439,23 +17245,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -11464,24 +17278,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -11490,23 +17311,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -11516,22 +17345,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -11540,45 +17378,68 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", - "actor_id", - "operation_type", "action", - "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot" - ] + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", + "operation_type", + "public_repo", + "actor_is_bot" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -11587,24 +17448,32 @@ "description": "Autofix for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11612,24 +17481,32 @@ "description": "Autofix for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11637,24 +17514,32 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11662,24 +17547,32 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11687,23 +17580,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -11714,17 +17616,29 @@ "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -11734,17 +17648,29 @@ "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -11754,25 +17680,31 @@ "description": "Code scanning using the default setup was disabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -11781,26 +17713,34 @@ "description": "Code scanning using the default setup was enabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "query_suite", "threat_model", - "languages", - "request_access_security_header" + "languages" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -11809,25 +17749,34 @@ "description": "Code scanning using the default setup was updated for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "query_suite", "threat_model", "languages", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Configuring default setup for code scanning" @@ -11837,19 +17786,30 @@ "description": "GitHub Codespaces was granted trusted repository access to this repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -11858,19 +17818,30 @@ "description": "GitHub Codespaces trusted repository access to this repository was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11878,17 +17849,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11897,15 +17881,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -11916,16 +17913,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11935,17 +17945,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11955,38 +17978,62 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.config.enable_sockpuppet_disallowed", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + }, + { + "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11995,26 +18042,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -12023,30 +18076,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -12056,20 +18114,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12078,25 +18147,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12105,23 +18182,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -12129,25 +18217,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -12157,23 +18254,32 @@ "description": "A source code archive of a repository was downloaded as a ZIP file.", "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "created_at", "operation_type", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" @@ -12183,24 +18289,32 @@ "description": "The setting for immutable releases was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -12209,20 +18323,30 @@ "description": "The setting for immutable releases was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -12233,23 +18357,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -12257,21 +18391,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -12279,21 +18423,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -12301,22 +18455,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -12324,21 +18487,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -12346,20 +18519,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -12367,22 +18551,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -12390,18 +18583,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -12409,22 +18616,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -12432,21 +18649,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -12454,18 +18681,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -12474,22 +18713,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12498,24 +18746,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12524,23 +18780,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -12548,26 +18814,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -12576,21 +18847,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -12599,25 +18879,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -12625,22 +18911,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -12649,25 +18945,34 @@ "description": "A branch was renamed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "old_branch", - "new_branch", - "default_branch", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "old_branch", + "new_branch", + "default_branch", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch" @@ -12677,19 +18982,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -12697,17 +19013,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -12716,17 +19047,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -12735,7 +19081,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -12750,22 +19117,30 @@ "description": "The cache retention policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -12777,22 +19152,30 @@ "description": "The cache storage policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -12804,23 +19187,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -12830,20 +19222,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -12854,21 +19257,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -12877,22 +19291,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -12901,21 +19325,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -12924,22 +19359,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -12950,16 +19395,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -12969,22 +19425,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -12993,23 +19460,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -13019,19 +19496,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -13039,21 +19526,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -13062,24 +19559,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -13087,25 +19593,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -13114,24 +19627,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13140,25 +19663,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -13167,22 +19698,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13191,26 +19731,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -13218,31 +19766,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13251,22 +19806,30 @@ "description": "Someone closed a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", "fields": [ - "actor", - "repo", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "user_agent", - "actor_id", - "request_id", - "action", - "operation_type", - "created_at", - "repo_id", - "_document_id", + "hashed_token", "org", "org_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "About repository security advisories" }, @@ -13275,18 +19838,29 @@ "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "repo", - "org_id", - "actor", + "@timestamp", + "_document_id", "action", - "request_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "_document_id", + "operation_type", "created_at" ] }, @@ -13295,17 +19869,30 @@ "description": "GitHub made a security advisory public in the GitHub Advisory Database.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -13314,21 +19901,30 @@ "description": "GitHub withdrew a security advisory that was published in error.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -13336,18 +19932,30 @@ "description": "Someone opened a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", "repo_id", - "action", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13355,21 +19963,30 @@ "description": "Someone published a security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", "@timestamp", - "actor", - "repo_id", "_document_id", - "repo", - "business_id", - "business", - "request_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "org" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13377,17 +19994,30 @@ "description": "Someone reopened as draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "repo", - "action", - "created_at", "@timestamp", - "request_id", - "actor_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "public_repo" ] }, @@ -13396,21 +20026,30 @@ "description": "Someone edited a draft or published security advisory.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "repo_id", - "org_id", "business", - "actor", - "user_agent", - "created_at", - "_document_id", "business_id", - "repo", - "action", - "operation_type", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13418,24 +20057,30 @@ "description": "Branch protections were disabled for the repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -13444,24 +20089,30 @@ "description": "Branch protections were enabled for this repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -13470,25 +20121,31 @@ "description": "Code security was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -13497,25 +20154,31 @@ "description": "Code security was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -13524,19 +20187,30 @@ "description": "Data use settings were disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "repo_id", - "request_id", - "actor_id", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -13545,21 +20219,30 @@ "description": "Data use settings were enabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "org", - "user_id", - "repo_id", "@timestamp", - "request_id", - "actor", + "_document_id", "action", - "operation_type", - "created_at", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org_id", - "_document_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -13568,23 +20251,30 @@ "description": "The dependency graph was disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "repo_id", - "operation_type", - "user_id", - "repo", + "@timestamp", "_document_id", - "actor", - "user", "action", - "@timestamp", - "org_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", - "request_id", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -13593,24 +20283,31 @@ "description": "The dependency graph was enabled for a private repository.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor_id", - "repo_id", + "created_at", "operation_type", - "actor", - "@timestamp", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13619,21 +20316,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -13641,21 +20348,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -13663,21 +20380,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -13685,20 +20413,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -13706,21 +20446,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -13728,19 +20479,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "actor", - "invitee", - "action", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -13748,17 +20512,31 @@ "description": "An organization has reached their repository limit.", "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "limit", "count", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -13769,17 +20547,31 @@ "description": "An organization is approaching their repository limit.", "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "limit", "count", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -13790,19 +20582,30 @@ "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", "fields": [ - "request_id", - "created_at", + "@timestamp", "_document_id", "action", - "user_agent", - "user", - "business_id", - "business", - "operation_type", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -13811,20 +20614,30 @@ "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "created_at", "@timestamp", - "repo", - "action", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "repo_id", - "actor", - "request_id", - "programmatic_access_type" + "created_at", + "operation_type" ] }, { @@ -13833,20 +20646,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", "created_at", - "org_id", - "action", - "user_id", - "operation_type", - "_document_id", - "actor_id", - "repo" + "operation_type" ] }, { @@ -13854,31 +20676,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -13887,19 +20717,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -13907,8 +20748,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -13917,23 +20757,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -13958,26 +20807,32 @@ "description": "Automatic partner validation checks have been disabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -13986,26 +20841,32 @@ "description": "Automatic partner validation checks have been enabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -14014,23 +20875,30 @@ "description": "A custom pattern was created for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14040,23 +20908,30 @@ "description": "A custom pattern was removed from secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14066,24 +20941,31 @@ "description": "A custom pattern was published for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14093,24 +20975,31 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -14119,24 +21008,31 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14146,23 +21042,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14172,23 +21075,31 @@ "description": "Secret scanning was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "public_repo", - "programmatic_access_type" + "public_repo" ], "docs_reference_titles": "About secret scanning" }, @@ -14197,22 +21108,30 @@ "description": "Secret scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14220,24 +21139,32 @@ "description": "Generic secrets have been disabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14245,22 +21172,31 @@ "description": "Generic secrets have been enabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14269,24 +21205,32 @@ "description": "Secret scanning for non-provider patterns was disabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -14295,24 +21239,32 @@ "description": "Secret scanning for non-provider patterns was enabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -14321,19 +21273,31 @@ "description": "A role or team was added to the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -14342,24 +21306,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -14368,24 +21340,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -14394,19 +21374,31 @@ "description": "A role or team was removed from the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -14415,26 +21407,31 @@ "description": "Secret scanning push protection was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -14443,26 +21440,31 @@ "description": "Secret scanning push protection was enabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -14471,28 +21473,36 @@ "description": "A code security configuration was applied to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14500,27 +21510,35 @@ "description": "A code security configuration failed to attach to the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14528,28 +21546,36 @@ "description": "A code security configuration was removed from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14557,28 +21583,36 @@ "description": "A code security configuration was removed due to a change in repository or enterprise settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14586,20 +21620,30 @@ "description": "The repository visibility change setting was cleared for an organization or enterprise.", "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", "fields": [ - "created_at", + "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", "business", - "action", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business_id", - "@timestamp", "user_agent", - "actor", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise" }, @@ -14608,20 +21652,30 @@ "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user", - "org_id", - "created_at", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "_document_id", - "@timestamp", - "user_id", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14629,19 +21683,30 @@ "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "_document_id", "@timestamp", - "user_agent", - "user", - "created_at", - "org", - "org_id", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14649,29 +21714,37 @@ "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -14680,29 +21753,37 @@ "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -14711,19 +21792,32 @@ "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ - "operation_type", - "request_id", - "repo_id", "@timestamp", - "user_agent", - "alert_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "alert_id", + "created_at", + "alert_number" ], "docs_reference_titles": "About Dependabot alerts" }, @@ -14732,23 +21826,32 @@ "description": "A Dependabot alert was manually dismissed.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "operation_type", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "alert_id", - "actor", - "repo", "created_at", - "org", - "_document_id", - "action", - "actor_id", "dismiss_reason", - "user", "dismiss_comment", "alert_number", "actor_is_bot" @@ -14759,21 +21862,33 @@ "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "public_repo", "owner", - "_document_id", - "@timestamp", "operation_type", - "token_scopes", "alert_number" ] }, @@ -14782,26 +21897,34 @@ "description": "A Dependabot alert was manually reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type", - "business", - "business_id", "public_repo", - "alert_number", - "request_access_security_header" + "alert_number" ] }, { @@ -14809,21 +21932,32 @@ "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", "docs_reference_links": "N/A", "fields": [ - "alert_id", - "repo", - "operation_type", - "action", - "repo_id", - "_document_id", - "user_agent", - "request_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "alert_id", + "operation_type", + "created_at", + "alert_number" ] }, { @@ -14831,21 +21965,35 @@ "description": "A Dependabot alert was withdrawn.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", "created_at", "active", - "action", - "repository_id", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type" ] }, @@ -14854,20 +22002,30 @@ "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", "fields": [ - "org", + "@timestamp", "_document_id", - "repo", - "org_id", - "operation_type", - "created_at", - "actor", "action", - "@timestamp", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" }, @@ -14876,24 +22034,31 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -14901,26 +22066,32 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14928,23 +22099,30 @@ "description": "Dependabot alerts was disabled.", "docs_reference_links": "N/A", "fields": [ - "repo", - "request_id", - "repo_id", - "action", - "actor_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "_document_id", "user_id", - "operation_type", - "token_scopes", - "programmatic_access_type" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14952,23 +22130,30 @@ "description": "Dependabot alerts was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_agent", - "created_at", "@timestamp", - "repo_id", + "_document_id", "action", - "user", - "repo", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor_id", - "_document_id", - "user_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot" ] }, @@ -14977,24 +22162,31 @@ "description": "A status check was marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "org", - "actor_id", "@timestamp", - "business", - "request_id", - "context", - "repo_id", - "action", - "repo", "_document_id", - "operation_type", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "actor", - "created_at", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "context", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -15003,21 +22195,31 @@ "description": "A status check was no longer marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "actor_id", - "actor", - "created_at", - "context", - "operation_type", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "repo_id", "org_id", - "action", - "_document_id", + "programmatic_access_type", "repo", - "programmatic_access_type" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "context", + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -15026,18 +22228,31 @@ "description": "Email notification restrictions for an organization or enterprise were disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -15046,19 +22261,31 @@ "description": "Email notification restrictions for an organization or enterprise were enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -15067,22 +22294,33 @@ "description": "A new custom repository role was created.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "name", - "owner", - "base_role", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "owner", + "base_role", "operation_type", - "@timestamp", - "_document_id", "role_permissions", "old_role_permissions" ], @@ -15093,23 +22331,34 @@ "description": "A custom repository role was deleted.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Managing custom repository roles for an organization" }, @@ -15118,23 +22367,34 @@ "description": "A custom repository role was edited.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "old_role_permissions", "old_base_role" ], @@ -15145,14 +22405,28 @@ "description": "A user was assigned to a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15167,14 +22441,28 @@ "description": "GitHub detected a secret and created a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15188,14 +22476,28 @@ "description": "A secret scanning alert was deleted by GitHub.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15211,14 +22513,28 @@ "description": "A secret scanning alert was leaked in a public repo.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15233,22 +22549,32 @@ "description": "A secret scanning alert was reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type_display_name" ] }, @@ -15257,14 +22583,28 @@ "description": "A leaked secret was reported to the secret's provider by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "created_at", @@ -15279,28 +22619,37 @@ "description": "A secret scanning alert was resolved.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "resolution", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", + "resolution", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type", "secret_type_display_name", "publicly_leaked", - "multi_repo", - "request_access_security_header" + "multi_repo" ] }, { @@ -15308,25 +22657,32 @@ "description": "A secret scanning alert was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "number", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -15334,14 +22690,28 @@ "description": "A user was unassigned from a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15356,14 +22726,28 @@ "description": "A secret scanning alert was validated.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "previous_validity", @@ -15380,26 +22764,34 @@ "description": "A request to close a secret scanning alert was approved by a user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "request_reviewer_comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15408,25 +22800,33 @@ "description": "N/A", "docs_reference_links": "A reqeust to close a secret scanning alert was canceled by a user.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "A, reqeust, to, close, a, secret, scanning, alert, was, canceled, by, a, user." @@ -15436,27 +22836,35 @@ "description": "N/A", "docs_reference_links": "A user requested to close a secret scanning alert.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "reason", "comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "A, user, requested, to, close, a, secret, scanning, alert." @@ -15466,26 +22874,34 @@ "description": "A request to close a secret scanning alert was denied by a user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "request_reviewer_comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15494,19 +22910,30 @@ "description": "Secret scanning was disabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -15515,19 +22942,30 @@ "description": "Secret scanning was enabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -15536,20 +22974,30 @@ "description": "Secret scanning was disabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -15558,19 +23006,30 @@ "description": "Secret scanning was enabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -15579,14 +23038,28 @@ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "push_protection_bypass_reason", @@ -15604,25 +23077,33 @@ "description": "A request to bypass secret scanning push protection was approved by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -15631,24 +23112,32 @@ "description": "A user canceled a request to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" @@ -15658,24 +23147,32 @@ "description": "A user pushed a commit containing a secret for which there is an approved secret scanning push protection bypass request.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" @@ -15685,25 +23182,33 @@ "description": "A request to bypass secret scanning push protection was denied by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", - "request_access_security_header", "request_reviewer_comment" ], "docs_reference_titles": "About push protection" @@ -15713,25 +23218,33 @@ "description": "A user requested to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" }, @@ -15740,22 +23253,35 @@ "description": "A secret scanning scan has completed on this repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "repo_id", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "source", "type", "source_slug", "type_slug", "started_at", "completed_at", - "repo", "public_repo", - "org", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "secret_types", @@ -15769,10 +23295,28 @@ "description": "A security configuration was created", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15787,15 +23331,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -15813,22 +23350,33 @@ "description": "A default security configuration setting for new repositories was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15837,22 +23385,33 @@ "description": "A default security configuration setting for new repositories was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15861,10 +23420,28 @@ "description": "A security configuration was deleted", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15879,15 +23456,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -15904,15 +23474,30 @@ "description": "A security configuration policy was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enforcement", "security_configuration_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15922,10 +23507,28 @@ "description": "A security configuration was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15940,15 +23543,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -15966,16 +23562,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15985,18 +23594,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -16005,16 +23627,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16024,15 +23659,28 @@ "description": "An agreement for invoiced billing for GitHub Sponsors was signed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -16044,15 +23692,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -16062,15 +23723,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -16079,17 +23755,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -16098,17 +23787,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -16117,16 +23820,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -16136,14 +23852,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -16153,17 +23884,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -16172,17 +23916,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -16191,18 +23948,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16211,15 +23981,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -16229,16 +24013,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", "user_agent", - "operation_type", - "_document_id", - "actor", - "actor_id", - "user_id" + "created_at", + "operation_type" ] }, { @@ -16246,15 +24043,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -16265,16 +24075,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -16284,17 +24107,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -16305,17 +24141,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -16326,18 +24175,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16347,16 +24207,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16366,16 +24239,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16387,17 +24273,30 @@ "fields": [ "@timestamp", "_document_id", - "fingerprint", - "operation_type", - "openssh_public_key", - "org_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "request_id" + "fingerprint", + "operation_type", + "openssh_public_key", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16406,19 +24305,32 @@ "description": "An SSH certificate authority for an organization or enterprise was deleted.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "created_at", + "@timestamp", "_document_id", - "fingerprint", - "operation_type", + "action", "actor", - "org_id", - "openssh_public_key", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", - "request_id" + "created_at", + "fingerprint", + "operation_type", + "openssh_public_key" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16427,21 +24339,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", "operation_type", - "_document_id", - "request_id", - "org", - "org_id", - "created_at", - "actor", - "action", - "user_id", - "business", - "business_id", - "@timestamp", - "actor_id" + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16450,19 +24371,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "actor_id", - "user_id", - "org", - "operation_type", - "request_id", "@timestamp", "_document_id", - "actor", - "user", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16471,15 +24403,28 @@ "description": "Dependabot encrypted config was read.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "public_repo" @@ -16490,20 +24435,34 @@ "description": "The verification code expiry time for an organization or enterprise domain was set.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "token_expires_at", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16511,18 +24470,33 @@ "description": "An organization or enterprise domain was unverified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ] }, { @@ -16530,16 +24504,31 @@ "description": "An organization or enterprise domain was verified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "domain_name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16547,23 +24536,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16571,23 +24570,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16595,23 +24604,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16619,23 +24638,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16643,21 +24672,31 @@ "description": "A member of an organization was added to a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", "fields": [ - "user_agent", - "request_id", - "org_id", - "user_id", - "team", - "user", "@timestamp", - "actor_id", - "created_at", - "operation_type", "_document_id", - "org", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" @@ -16667,22 +24706,31 @@ "description": "A team was given access and permissions to a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "team", - "action", - "operation_type", - "request_id", - "created_at", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "actor_id", - "_document_id", "repo_id", - "user_agent", - "org_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -16691,20 +24739,30 @@ "description": "A team was added to an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team_type", "team", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -16715,20 +24773,31 @@ "description": "A child team was created or a child team's parent was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", "fields": [ - "org", "@timestamp", - "created_at", "_document_id", - "team", "action", - "operation_type", "actor", - "request_id", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", + "operation_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" }, @@ -16737,18 +24806,31 @@ "description": "A team's privacy level was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", "fields": [ - "user_agent", - "request_id", - "org", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", "created_at", "operation_type", - "actor_id", - "org_id", - "@timestamp", - "actor", - "_document_id", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" @@ -16758,21 +24840,32 @@ "description": "A new team is created.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "oauth_application_id", + "operation_type", "team", - "org", - "actor", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "team_type" ] }, @@ -16781,21 +24874,31 @@ "description": "A user was demoted from a team maintainer to a team member.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" }, @@ -16804,19 +24907,31 @@ "description": "A team was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "team", "org_id", - "actor_id", - "actor", - "action", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", "operation_type", - "_document_id", - "programmatic_access_type", "team_type" ] }, @@ -16825,19 +24940,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "business_id", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", "actor_id", - "user", "business", - "action", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16845,19 +24971,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "operation_type", - "request_id", "actor", - "org", - "created_at", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", - "_document_id" + "operation_type", + "created_at" ] }, { @@ -16865,18 +25002,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", "@timestamp", - "action", "_document_id", - "user_agent", - "user_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business", + "user_id", + "user_agent", "operation_type", - "actor", "created_at" ] }, @@ -16885,19 +25033,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "actor", - "action", - "operation_type", - "team", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "team" ] }, { @@ -16905,19 +25065,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", "@timestamp", - "actor_id", "_document_id", - "team", - "created_at", - "org_id", "action", - "request_id", - "user_agent", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_access_security_header" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "team", + "created_at" ] }, { @@ -16925,22 +25097,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "team", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at" ] }, { @@ -16948,22 +25129,31 @@ "description": "A user was promoted from a team member to a team maintainer.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" }, @@ -16972,20 +25162,30 @@ "description": "A team was removed from an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team_type", "team", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -16996,22 +25196,31 @@ "description": "An organization member was removed from a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", "fields": [ - "request_id", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "team", - "user_id", - "actor", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", + "user_id", "user_agent", - "_document_id", - "token_scopes", - "programmatic_access_type", + "operation_type", + "created_at", + "team", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" @@ -17021,43 +25230,64 @@ "description": "A repository was removed from a team's control.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "org_id", - "repo", - "repo_id", - "action", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "created_at", "team", - "org", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { "action": "team.rename", - "description": "A team's name was changed.", - "docs_reference_links": "N/A", - "fields": [ - "name", - "user_agent", - "created_at", - "team", - "operation_type", - "actor_id", - "org", + "description": "A team's name was changed.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", "action", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "_document_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "team", + "operation_type", "team_type" ] }, @@ -17066,17 +25296,30 @@ "description": "Team synchronization with a tenant was disabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "request_id", - "org_id", "actor_id", - "operation_type", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -17085,19 +25328,30 @@ "description": "Team synchronization with a tenant was enabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ - "org_id", - "business_id", - "actor", - "created_at", - "user_agent", "@timestamp", - "operation_type", - "business", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -17106,19 +25360,30 @@ "description": "The Okta credentials for team synchronization with a tenant were changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -17126,28 +25391,37 @@ "description": "A team's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "team", - "org_id", "@timestamp", - "org", "_document_id", - "old_permission", - "request_id", - "repo", "action", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "old_permission", "operation_type", "created_at", - "user_agent", "permission", "new_repo_permission", "new_repo_base_role", "old_repo_permission", - "old_repo_base_role", - "token_scopes", - "programmatic_access_type" + "old_repo_base_role" ] }, { @@ -17155,23 +25429,38 @@ "description": "Triggered when a user content edit is deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_content_id", "user_content_type", "created_at", - "user_agent", "deleted_by", "editor_id", - "_document_id", "deleted_at", - "action", - "actor_id", "editor", "deleted_by_id", "deleted_content", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -17179,16 +25468,30 @@ "description": "A Dependabot rule was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17198,16 +25501,30 @@ "description": "A Dependabot rule was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17217,18 +25534,31 @@ "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17238,21 +25568,33 @@ "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17260,21 +25602,32 @@ "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -17282,21 +25635,32 @@ "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -17304,16 +25668,30 @@ "description": "A Dependabot rule's conditions, actions, or metadata changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17323,27 +25701,33 @@ "description": "A workflow job was approved.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", - "repo", - "repo_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -17352,23 +25736,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17376,10 +25770,28 @@ "description": "A workflow run was cancelled.", "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17390,20 +25802,9 @@ "run_number", "cancelled_at", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Canceling a workflow run" }, @@ -17412,23 +25813,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17438,10 +25847,28 @@ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17453,19 +25880,9 @@ "conclusion", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -17476,10 +25893,28 @@ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17488,21 +25923,10 @@ "head_branch", "head_sha", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "public_repo", - "programmatic_access_type", "actor_is_bot", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "Understanding GitHub Actions" @@ -17512,23 +25936,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -17537,22 +25973,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -17560,21 +26007,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -17582,25 +26040,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -17608,23 +26074,36 @@ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", "fields": [ - "repo_id", - "repo", - "org_id", - "org", - "business_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "job_name", "runner_labels", "is_hosted_runner", "environment_name", "secrets_passed", - "action", - "_document_id", "operation_type", "created_at", - "@timestamp", "runner_owner_type", "job_workflow_ref", "calling_workflow_refs", @@ -17638,24 +26117,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -17664,10 +26152,28 @@ "description": "A workflow run was re-run.", "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17677,21 +26183,11 @@ "head_sha", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", "rerun_type", "check_run_id", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "Re-running workflows and jobs" @@ -17701,25 +26197,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.19/user.json b/src/audit-logs/data/ghes-3.19/user.json index f91931785d5f..d05abaa0f734 100644 --- a/src/audit-logs/data/ghes-3.19/user.json +++ b/src/audit-logs/data/ghes-3.19/user.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,17 +67,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "request_id", "@timestamp", - "user_agent", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", - "user_id", + "token_scopes", "user", - "actor", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -61,18 +98,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", + "token_scopes", "user", - "request_id", - "_document_id", - "user_agent", - "actor", "user_id", - "actor_id", - "operation_type", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -80,18 +129,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "actor_id", - "operation_type", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "token_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -99,29 +160,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -129,18 +196,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -148,21 +227,34 @@ "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -178,22 +270,34 @@ "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "uuid", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -201,25 +305,37 @@ "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", - "request_access_security_header", "old_target_amount", "old_budget_limit_type", "old_alert_enabled", @@ -233,17 +349,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -252,19 +381,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -273,15 +414,28 @@ "description": "Azure subscription has been linked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -291,15 +445,28 @@ "description": "Azure subscription has been unlinked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -309,18 +476,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -328,18 +508,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -347,15 +539,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -365,26 +570,36 @@ "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -392,24 +607,34 @@ "description": "A CSV export was requested on the \"Coverage\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -417,26 +642,36 @@ "description": "A CSV export was requested on the \"Overview Dashboard\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -444,20 +679,31 @@ "description": "A CSV export was requested on the \"Risk\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "user", - "user_id", - "query", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -468,17 +714,29 @@ "description": "The cache retention policy for GitHub Actions was set for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type", "actor_is_bot" @@ -490,17 +748,29 @@ "description": "The cache storage policy for GitHub Actions was set for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type", "actor_is_bot" @@ -512,17 +782,30 @@ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "created_at", "operation_type" ], @@ -533,20 +816,32 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -555,19 +850,32 @@ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "limit", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -576,19 +884,31 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -597,20 +917,32 @@ "description": "The policy for fork pull request workflows was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -619,19 +951,31 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -640,42 +984,64 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" - ], - "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -686,17 +1052,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -704,14 +1082,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -721,25 +1114,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -750,22 +1152,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -777,22 +1190,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -801,15 +1225,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -820,17 +1259,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -840,27 +1292,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "org", "owner", "pull_request_id", "machine_type", - "user_id", - "user", "devcontainer_path", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -868,19 +1329,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -888,18 +1362,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -908,23 +1394,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -932,16 +1425,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -950,24 +1457,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -975,15 +1488,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -993,20 +1519,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -1014,19 +1550,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -1034,21 +1582,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1056,22 +1613,33 @@ "description": "Specific repositories were disabled from using Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "owner_type", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1079,21 +1647,31 @@ "description": "Specific repositories were enabled to use Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "owner_type", - "owner", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1103,20 +1681,32 @@ "description": "Copilot coding agent access was updated for the organization's or user's repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_access", "old_access", - "org_id", "owner_type", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1126,21 +1716,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1150,19 +1749,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1172,21 +1780,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1196,19 +1813,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1217,19 +1845,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1238,19 +1877,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1259,19 +1909,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1280,17 +1941,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1298,19 +1972,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1319,19 +2004,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1339,19 +2035,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1360,19 +2067,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1380,19 +2098,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1401,19 +2130,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1421,19 +2161,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1442,20 +2193,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1463,22 +2224,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1487,22 +2257,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1510,28 +2290,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1540,27 +2326,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -1569,25 +2363,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1596,26 +2398,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1624,21 +2433,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1647,22 +2468,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1671,49 +2502,70 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "public_repo", "programmatic_access_type", - "request_access_security_header" - ], - "docs_reference_titles": "Managing environments for deployment" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "visibility", + "operation_type", + "created_at", + "public_repo" + ], + "docs_reference_titles": "Managing environments for deployment" }, { "action": "environment.update_actions_variable", "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1722,21 +2574,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -1747,21 +2609,32 @@ "description": "A gist was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "gist_id", - "@timestamp", "created_at", "operation_type", - "user_agent", - "actor", - "actor_id", - "visibility", - "action", - "_document_id", - "token_scopes", - "programmatic_access_type" + "visibility" ] }, { @@ -1769,20 +2642,32 @@ "description": "A gist was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "gist_id", - "visibility", - "created_at", + "@timestamp", "_document_id", - "user", - "request_id", - "operation_type", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "@timestamp", - "programmatic_access_type" + "gist_id", + "visibility", + "created_at", + "operation_type" ] }, { @@ -1790,21 +2675,32 @@ "description": "The visibility of a gist was updated.", "docs_reference_links": "N/A", "fields": [ - "action", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", - "user", - "gist_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "visibility", - "user_id", - "created_at", - "_document_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "gist_id", + "visibility", + "created_at" ] }, { @@ -1812,22 +2708,33 @@ "description": "An SSH key was added to a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -1836,23 +2743,34 @@ "description": "An SSH key was removed from a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", "explanation", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -1861,23 +2779,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1885,18 +2812,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", - "org", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1907,20 +2844,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1930,18 +2877,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "created_at", - "user_id", "@timestamp", - "user", - "operation_type", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -1949,18 +2908,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "created_at", - "_document_id", + "user_id", "user_agent", - "@timestamp", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -1968,25 +2939,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -1994,25 +2975,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -2020,26 +3010,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -2048,25 +3047,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -2074,26 +3082,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -2101,21 +3118,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -2124,19 +3152,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -2144,21 +3185,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -2167,19 +3219,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -2190,20 +3256,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2213,24 +3291,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2241,23 +3330,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2268,20 +3369,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2291,19 +3405,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -2312,20 +3440,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -2335,20 +3476,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -2357,20 +3511,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -2379,20 +3546,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -2400,19 +3579,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2421,19 +3613,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2442,17 +3647,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2465,21 +3683,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -2493,17 +3724,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2515,20 +3759,30 @@ "description": "An issue was marked as blocked by another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -2539,19 +3793,30 @@ "description": "The blocked by relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2561,20 +3826,30 @@ "description": "An issue was marked as blocking another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -2585,20 +3860,30 @@ "description": "The blocking relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -2609,18 +3894,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2628,21 +3925,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -2650,21 +3960,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -2672,22 +3995,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -2695,19 +4031,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -2718,21 +4067,36 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "actor", + "_document_id", "action", - "operation_type", - "marketplace_listing", - "has_free_trial", - "user_agent", - "request_id", + "actor", "actor_id", - "yearly_price_in_cents", - "description", - "bullets", - "monthly_price_in_cents", - "marketplace_listing_plan", - "_document_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "marketplace_listing", + "has_free_trial", + "yearly_price_in_cents", + "description", + "bullets", + "monthly_price_in_cents", + "marketplace_listing_plan" ] }, { @@ -2740,22 +4104,37 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "marketplace_listing_plan", "marketplace_listing", "description", "bullets", "has_free_trial", "created_at", - "actor_id", "operation_type", - "_document_id", - "action", - "user_agent", - "request_id", - "actor", "monthly_price_in_cents", - "yearly_price_in_cents", - "@timestamp" + "yearly_price_in_cents" ] }, { @@ -2763,21 +4142,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor", - "marketplace_listing_plan", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "marketplace_listing_plan", "description", "yearly_price_in_cents", - "@timestamp", "created_at", - "actor_id", "bullets", "has_free_trial", "marketplace_listing", - "user_agent", "monthly_price_in_cents", - "action", "operation_type" ] }, @@ -2786,21 +4180,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "monthly_price_in_cents", - "marketplace_listing", + "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "monthly_price_in_cents", + "marketplace_listing", "description", "bullets", "yearly_price_in_cents", - "request_id", - "actor_id", "has_free_trial", "marketplace_listing_plan", - "user_agent", - "@timestamp", "operation_type", - "actor", "created_at" ] }, @@ -2809,22 +4218,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -2832,22 +4254,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2855,19 +4290,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2875,21 +4322,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2899,16 +4355,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2918,18 +4387,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "max_entries_to_build", - "min_entries_to_merge", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "_document_id", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "max_entries_to_build", + "min_entries_to_merge", + "public_repo", "created_at", "operation_type" ] @@ -2939,14 +4421,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -2954,19 +4452,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -2974,18 +4483,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -2993,23 +4514,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -3017,20 +4546,30 @@ "description": "An OAuth access token was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", "fields": [ - "_document_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "user", - "user_id", - "created_at", + "_document_id", "action", + "actor", "actor_id", - "request_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" @@ -3041,19 +4580,30 @@ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", "fields": [ "@timestamp", - "user_agent", - "action", - "operation_type", "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_id", + "user_agent", + "operation_type", + "created_at", "explanation", - "hashed_token", - "actor_id", - "token_scopes", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" @@ -3063,19 +4613,30 @@ "description": "An OAuth access token was regenerated.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "_document_id", - "created_at", "@timestamp", - "operation_type", + "_document_id", "action", - "user_agent", - "request_id", "actor", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "oauth_application_name" ] }, @@ -3084,16 +4645,28 @@ "description": "An OAuth access token was revoked.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "request_access_security_header", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -3103,39 +4676,63 @@ "description": "An OAuth access token was updated.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", "action", - "@timestamp", - "user", - "user_agent", - "request_access_security_header" - ] - }, - { - "action": "oauth_application.create", - "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "oauth_application_id", - "operation_type", - "user_agent", - "actor_id", "org_id", - "action", - "actor", - "oauth_application", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "oauth_application.create", + "description": "An OAuth application was created.", + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3144,20 +4741,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3166,20 +4775,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3188,20 +4809,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3210,19 +4843,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3231,20 +4877,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3253,20 +4911,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3275,19 +4945,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3296,24 +4979,31 @@ "description": "An authorization for an OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ - "operation_type", - "user_agent", - "user_id", - "actor", - "org_id", + "@timestamp", "_document_id", - "request_id", "action", - "@timestamp", - "created_at", + "actor", "actor_id", - "user", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_is_bot", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -3323,20 +5013,31 @@ "description": "An authorization for an OAuth application was deleted.", "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", "fields": [ - "user_agent", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "actor", "created_at", "explanation", - "user", - "user_id", - "org_id", - "action", - "actor_id", - "token_scopes", "actor_is_bot", "oauth_application_name" ], @@ -3347,20 +5048,31 @@ "description": "An authorization for an OAuth application was updated.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", - "actor_id", "user_agent", - "@timestamp", "operation_type", - "action", - "user", "created_at", - "_document_id", "actor_is_bot", - "request_access_security_header", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -3370,21 +5082,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -3393,24 +5115,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3418,20 +5150,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -3439,22 +5181,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -3462,20 +5212,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -3483,22 +5243,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -3506,21 +5274,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3528,26 +5305,35 @@ "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -3556,26 +5342,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3583,28 +5377,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3612,26 +5414,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3639,18 +5449,28 @@ "description": "The cache retention policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -3662,18 +5482,28 @@ "description": "The cache storage policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -3685,20 +5515,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -3707,16 +5548,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -3727,18 +5581,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -3747,18 +5614,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -3767,18 +5646,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -3787,18 +5679,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -3808,20 +5712,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -3829,17 +5744,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -3849,20 +5777,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -3871,20 +5810,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -3893,17 +5846,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3914,20 +5882,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -3936,19 +5918,31 @@ "description": "A new passkey was added.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" + "user_agent", + "nickname", + "created_at", + "operation_type" ] }, { @@ -3956,19 +5950,31 @@ "description": "A new passkey was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3976,18 +5982,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3995,16 +6013,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -4012,18 +6044,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -4031,18 +6075,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4053,18 +6110,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4075,17 +6145,30 @@ "description": "Triggered when you create a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4095,19 +6178,31 @@ "description": "Triggered when you regenerate a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4115,12 +6210,29 @@ "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", "fields": [ - "user_programmatic_access_name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", "operation_type" ], @@ -4131,38 +6243,63 @@ "description": "Triggered when you delete a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", - "user", - "user_id", - "explanation", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ] - }, + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", + "explanation", + "created_at", + "operation_type" + ] + }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -4173,18 +6310,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -4196,17 +6346,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -4218,17 +6381,30 @@ "description": "A fine-grained personal access token was updated.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4239,15 +6415,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4257,17 +6448,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4277,15 +6479,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4295,17 +6512,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4315,17 +6543,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4335,17 +6574,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4355,17 +6605,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4375,17 +6636,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -4395,17 +6669,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4413,20 +6700,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -4436,25 +6734,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -4462,20 +6772,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4483,25 +6805,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4509,17 +6843,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -4527,17 +6874,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -4545,18 +6905,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -4565,18 +6937,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -4585,19 +6969,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -4605,17 +7000,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -4627,22 +7035,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -4650,19 +7067,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -4670,17 +7098,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4688,18 +7129,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -4707,20 +7161,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4728,38 +7192,62 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" - }, + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -4768,16 +7256,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -4789,21 +7290,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -4811,18 +7324,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4833,23 +7359,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -4858,24 +7395,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -4884,20 +7432,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4906,21 +7468,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -4930,22 +7505,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "key", - "fingerprint", - "read_only", - "repo_id", - "operation_type", - "created_at", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "fingerprint", + "read_only", + "operation_type", + "created_at", + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4954,25 +7541,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4981,23 +7578,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", "key", "fingerprint", - "actor_id", - "actor", "title", - "user_agent", - "user_id", - "request_id", - "read_only", - "token_scopes", - "programmatic_access_type" + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -5006,22 +7614,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -5030,21 +7648,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -5053,25 +7680,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -5080,23 +7714,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -5105,24 +7747,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -5131,23 +7780,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -5157,22 +7814,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -5181,19 +7847,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -5202,24 +7881,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -5228,23 +7917,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -5255,17 +7953,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -5274,15 +7985,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -5293,16 +8017,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -5312,17 +8049,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -5332,19 +8082,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -5353,45 +8114,64 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, { "action": "repo.configure_self_hosted_jit_runner", "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -5400,30 +8180,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -5433,20 +8218,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5455,25 +8251,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5482,23 +8286,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -5506,25 +8321,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -5534,23 +8358,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -5558,21 +8392,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -5580,21 +8424,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -5602,22 +8456,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -5625,21 +8488,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -5647,20 +8520,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -5668,22 +8552,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -5691,18 +8584,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5710,22 +8617,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5733,21 +8650,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -5755,42 +8682,63 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", - "repo_id", - "request_access_security_header" - ], - "docs_reference_titles": "Adding self-hosted runners" - }, - { - "action": "repo.remove_actions_secret", - "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", - "fields": [ - "user_agent", - "request_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", + "created_at" + ], + "docs_reference_titles": "Adding self-hosted runners" + }, + { + "action": "repo.remove_actions_secret", + "description": "A GitHub Actions secret was deleted for a repository.", + "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", + "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5799,24 +8747,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5825,23 +8781,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -5849,26 +8815,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -5877,21 +8848,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -5900,25 +8880,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -5926,22 +8912,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -5950,42 +8946,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" - ] + "operation_type", + "created_at" + ] }, { "action": "repo.set_actions_cache_retention_policy", "description": "The cache retention policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -5997,22 +9012,30 @@ "description": "The cache storage policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -6024,23 +9047,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -6050,20 +9082,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -6074,21 +9117,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -6097,22 +9151,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -6121,21 +9185,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -6144,22 +9219,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -6170,16 +9255,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -6188,22 +9284,31 @@ "description": "Temporary access was enabled for a repository.", "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing user-owned repositories in your enterprise" }, @@ -6213,22 +9318,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -6237,23 +9353,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -6263,19 +9389,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -6283,21 +9419,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -6306,24 +9452,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -6331,25 +9486,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -6358,24 +9520,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -6384,25 +9556,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -6411,22 +9591,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -6435,26 +9624,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -6462,31 +9659,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -6495,21 +9699,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -6517,21 +9731,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -6539,21 +9763,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -6561,20 +9796,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -6582,21 +9829,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -6604,51 +9862,72 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", - "actor_id", - "operation_type", - "created_at", - "inviter", - "user_agent", - "repo_id" - ] - }, - { - "action": "repository_ruleset.create", - "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", - "fields": [ "actor", "actor_id", - "user_agent", - "request_id", - "name", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", + "created_at", + "inviter" + ] + }, + { + "action": "repository_ruleset.create", + "description": "A repository ruleset was created.", + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "public_repo", + "created_at", + "operation_type", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -6657,19 +9936,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -6677,8 +9967,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -6687,23 +9976,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -6728,18 +10026,30 @@ "description": "A security key was registered for an account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "created_at", - "user_id", - "action", - "operation_type", - "request_id", "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -6747,18 +10057,30 @@ "description": "A security key was removed from an account.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "operation_type", - "_document_id", - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6766,14 +10088,28 @@ "description": "A user linked a social identity to their account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -6783,14 +10119,28 @@ "description": "A user unlinked a social identity from their account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "action", - "_document_id", - "@timestamp", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -6800,15 +10150,28 @@ "description": "A user unlinked all social identities from their account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -6818,16 +10181,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6837,18 +10213,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -6857,16 +10246,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6877,15 +10279,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -6895,15 +10310,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -6912,17 +10342,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -6931,17 +10374,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -6950,16 +10407,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -6969,14 +10439,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -6986,17 +10471,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -7005,17 +10503,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -7024,18 +10535,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7044,15 +10568,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -7062,16 +10600,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7079,15 +10630,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -7098,16 +10662,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -7117,17 +10694,30 @@ "description": "Triggered when you send an email update to your sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", "fields": [ - "request_id", - "actor", - "action", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" }, @@ -7136,17 +10726,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -7157,17 +10760,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -7178,18 +10794,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -7199,16 +10826,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -7218,17 +10858,30 @@ "description": "You join the waitlist to join GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_id", - "user_agent", "actor_id", - "action", - "operation_type", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "_document_id" + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -7237,16 +10890,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -7256,23 +10922,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7280,23 +10956,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7304,23 +10990,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7328,23 +11024,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7352,15 +11058,30 @@ "description": "Triggered when you accept a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7369,15 +11090,30 @@ "description": "Triggered when you cancel a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7386,15 +11122,30 @@ "description": "Triggered when you create a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7403,32 +11154,62 @@ "description": "Triggered when you decline a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ], - "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" - }, - { - "action": "successor_invitation.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" + }, + { + "action": "successor_invitation.destroy", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7436,15 +11217,30 @@ "description": "Triggered when you revoke a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7453,17 +11249,30 @@ "description": "A new trusted device was added.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7471,17 +11280,30 @@ "description": "A trusted device was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7489,14 +11311,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "action", - "request_id", - "user_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -7505,15 +11342,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "created_at", - "user_id", - "operation_type", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action" + "created_at", + "operation_type" ] }, { @@ -7521,13 +11373,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "created_at", - "user_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7535,17 +11404,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "operation_type", - "action", - "_document_id" + "created_at", + "operation_type" ] }, { @@ -7553,17 +11435,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user", - "created_at", - "request_id", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -7571,16 +11466,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "operation_type", "@timestamp", - "user_agent", - "request_id", - "created_at", - "user_id", - "action", "_document_id", - "request_access_security_header" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7588,15 +11497,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_id", - "action", "@timestamp", - "created_at", - "user_agent", - "user", "_document_id", - "request_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7604,18 +11528,30 @@ "description": "A secondary authentication factor was added to a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -7624,18 +11560,30 @@ "description": "Two-factor authentication was disabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", "fields": [ - "actor", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor_id", + "user_agent", "created_at", - "operation_type", - "request_id", - "@timestamp", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Disabling two-factor authentication for your personal account" }, @@ -7644,18 +11592,30 @@ "description": "Two-factor authentication was enabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ - "actor", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Configuring two-factor authentication" }, @@ -7664,15 +11624,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user", - "user_id", - "action", "@timestamp", - "request_id", "_document_id", - "user_agent" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7680,16 +11655,29 @@ "description": "Two factor recovery codes were regenerated for a user account.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", + "operation_type", "created_at" ] }, @@ -7698,18 +11686,30 @@ "description": "A secondary authentication factor was removed from a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -7718,15 +11718,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "created_at", - "_document_id", - "action", - "@timestamp" + "operation_type", + "created_at" ] }, { @@ -7735,16 +11750,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "operation_type", "user_agent", - "action", - "request_id", - "actor", - "actor_id" + "created_at", + "operation_type" ] }, { @@ -7752,19 +11780,31 @@ "description": "An email address was added to a user account.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", "action", - "request_id", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", "operation_type", - "_document_id", - "actor_id", - "actor", "email", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding an email address to your GitHub account" }, @@ -7773,18 +11813,30 @@ "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "created_at", - "user", "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -7792,15 +11844,28 @@ "description": "Audit log entries were exported.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "action", - "request_id", - "actor", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", "created_at" ] @@ -7810,20 +11875,31 @@ "description": "A user was blocked by another user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_id", - "_document_id", "actor_id", - "@timestamp", - "user_agent", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -7831,18 +11907,30 @@ "description": "A user changed their password.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "actor_id", - "operation_type", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "created_at", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7850,18 +11938,30 @@ "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -7870,17 +11970,30 @@ "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -7889,19 +12002,31 @@ "description": "A new user account was created.", "docs_reference_links": "N/A", "fields": [ - "email", - "user_id", - "operation_type", "@timestamp", - "request_id", - "user", - "created_at", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "action", - "programmatic_access_type" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "email", + "operation_type", + "created_at" ] }, { @@ -7909,21 +12034,33 @@ "description": "A user secret for Codespaces was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7931,39 +12068,62 @@ "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "user_agent", + "@timestamp", "_document_id", - "operation_type", - "oauth_application_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "@timestamp", + "token_id", "token_scopes", - "programmatic_access_type" - ] - }, - { + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" + ] + }, + { "action": "user.delete", "description": "A user account was destroyed by an asynchronous job.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "request_id", - "user_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7972,19 +12132,30 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "oauth_application_id", + "_document_id", "action", - "user", - "created_at", - "user_agent", - "request_id", "actor", "actor_id", - "operation_type", - "_document_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", + "operation_type" ] }, { @@ -7992,18 +12163,30 @@ "description": "A user deleted his or her account, triggering user.async_delete.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", - "created_at", - "user_agent", "user_id", - "operation_type", - "actor_id", - "action", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8011,18 +12194,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "user_agent", "user_id", - "actor_id", - "action", - "operation_type", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8030,18 +12225,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "operation_type", - "created_at", - "_document_id", - "@timestamp", - "user", - "actor_id", - "action", - "request_access_security_header" + "created_at" ] }, { @@ -8050,17 +12257,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user", "_document_id", "action", - "operation_type", - "user_agent", - "created_at", - "request_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8068,17 +12287,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8086,17 +12318,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8104,17 +12349,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8122,21 +12380,31 @@ "description": "An enterprise managed user claimed an email address.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "actor_is_bot", - "request_access_security_header" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -8144,21 +12412,31 @@ "description": "N/A", "docs_reference_links": "An enterprise managed user unclaimed an email address.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." }, @@ -8167,17 +12445,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8185,17 +12476,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8203,17 +12507,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8221,18 +12538,30 @@ "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "action", - "operation_type", - "request_id", - "created_at", - "_document_id", "@timestamp", - "user", - "org_id", + "_document_id", + "action", "actor", "actor_id", - "user_agent" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8240,17 +12569,31 @@ "description": "A user requested a password reset.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", "fields": [ - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "email", - "created_at", - "user_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" }, @@ -8259,17 +12602,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "created_at", - "user_agent", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor", - "operation_type", - "request_id" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8277,18 +12633,30 @@ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -8297,19 +12665,31 @@ "description": "A user signed in.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "actor_id", "@timestamp", - "user", - "action", - "operation_type", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "actor", - "passkey_nickname", - "request_access_security_header" + "passkey_nickname" ] }, { @@ -8317,18 +12697,30 @@ "description": "A user signed out.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8336,18 +12728,30 @@ "description": "A user signed in from a new device.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8355,21 +12759,31 @@ "description": "An ordinary user account was promoted to a site administrator.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", + "user_id", "user_agent", + "created_at", "oauth_application_id", - "request_id", - "operation_type", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8377,16 +12791,29 @@ "description": "A user's account was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user", - "action", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "actor", "operation_type" ] }, @@ -8395,20 +12822,31 @@ "description": "An email address was removed from a user account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "actor", - "actor_id", "created_at", - "email", - "token_scopes", - "programmatic_access_type" + "email" ] }, { @@ -8416,20 +12854,32 @@ "description": "A user secret for Codespaces was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "key", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "key", + "integration", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8437,20 +12887,31 @@ "description": "A username was changed.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "request_id", - "actor_id", - "old_login", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "operation_type", "user_agent", - "token_scopes", - "programmatic_access_type" + "old_login", + "created_at", + "operation_type" ] }, { @@ -8458,18 +12919,30 @@ "description": "A user reset their account password.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "@timestamp", - "_document_id", - "actor", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8477,16 +12950,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_id", - "action", "@timestamp", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -8497,16 +12983,28 @@ "fields": [ "@timestamp", "_document_id", - "request_id", - "user_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor_id", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -8515,18 +13013,30 @@ "description": "A user signed in from an unrecognized device.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "created_at", - "actor", - "actor_id", - "@timestamp", - "request_access_security_header" + "created_at" ] }, { @@ -8534,18 +13044,30 @@ "description": "A user signed in from an unrecognized device and location.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "created_at", - "_document_id", - "request_id", - "action", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8553,22 +13075,33 @@ "description": "Triggered when you clear the status on your profile.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "message", - "user", - "actor_id", "created_at", - "request_id", "limited_availability", - "action", "emoji", - "operation_type", - "user_agent", - "@timestamp", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -8576,23 +13109,33 @@ "description": "Triggered when you set or change the status on your profile.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", "fields": [ - "limited_availability", - "user", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "message", - "user_id", - "created_at", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "limited_availability", + "message", + "created_at", "emoji", - "org", - "actor", - "operation_type", - "token_scopes", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Personalize your profile" }, @@ -8601,21 +13144,31 @@ "description": "A user account was suspended.", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", - "operation_type", - "actor_id", - "user", - "user_agent", - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", - "user_id", + "_document_id", "action", - "token_scopes", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -8623,18 +13176,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", - "actor_id", "@timestamp", - "operation_type", "_document_id", - "user_agent", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8642,18 +13207,30 @@ "description": "A 2FA challenge issued for a user account failed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "_document_id", - "user_agent", - "user", - "actor_id", - "actor", - "user_id", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8663,16 +13240,28 @@ "fields": [ "@timestamp", "_document_id", - "user_id", - "operation_type", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "actor", + "user_id", "user_agent", - "request_id", - "action", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8680,18 +13269,30 @@ "description": "A user used their 2FA recovery codes.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "user_agent", - "request_id", - "user", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "created_at", - "@timestamp", - "_document_id", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8699,18 +13300,30 @@ "description": "A user downloaded 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8718,17 +13331,30 @@ "description": "A user printed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", - "user_agent", - "request_id", - "user_id", - "created_at", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8736,18 +13362,30 @@ "description": "A user viewed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", "created_at", - "user", - "operation_type", - "@timestamp", - "request_id", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -8755,17 +13393,30 @@ "description": "A user was prompted for a two-factor authentication code.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", "fields": [ - "user", - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "actor" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" }, @@ -8774,19 +13425,31 @@ "description": "A user was unblocked by another user.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "actor", - "@timestamp", - "user_agent", - "user_id", - "user", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -8794,21 +13457,31 @@ "description": "A user account was unsuspended.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", - "user", "action", - "user_agent", "actor", - "oauth_application_id", - "operation_type", "actor_id", - "created_at", - "@timestamp", - "user_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -8816,21 +13489,33 @@ "description": "A user secret for Codespaces was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8838,46 +13523,64 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", + "operation_type" + ] + }, + { + "action": "workflows.approve_workflow_job", + "description": "A workflow job was approved.", + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" - ] - }, - { - "action": "workflows.approve_workflow_job", - "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", - "fields": [ "user_agent", - "request_id", - "actor", - "actor_id", "workflow_run_id", "run_number", - "user", - "user_id", - "repo", - "repo_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -8886,23 +13589,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8910,23 +13623,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8936,23 +13657,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -8961,22 +13694,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8984,21 +13728,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -9006,25 +13761,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9032,24 +13795,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -9058,25 +13830,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.20/enterprise.json b/src/audit-logs/data/ghes-3.20/enterprise.json index 77205f9f3c9f..1bdd61afc71d 100644 --- a/src/audit-logs/data/ghes-3.20/enterprise.json +++ b/src/audit-logs/data/ghes-3.20/enterprise.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,17 +67,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "request_id", "@timestamp", - "user_agent", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", - "user_id", + "token_scopes", "user", - "actor", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -61,18 +98,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", + "token_scopes", "user", - "request_id", - "_document_id", - "user_agent", - "actor", "user_id", - "actor_id", - "operation_type", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -80,18 +129,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "actor_id", - "operation_type", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "token_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -99,29 +160,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -129,31 +196,34 @@ "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests", "fields": [ - "user_agent", - "request_id", - "request_method", - "query_string", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", - "request_body", - "status_code", - "url_path", "business", "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "request_method", + "query_string", + "request_body", + "status_code", + "url_path", + "public_repo", "created_at", "operation_type", "route", @@ -167,18 +237,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -186,20 +268,32 @@ "description": "A manual check of the endpoint configured for audit log streaming was performed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "audit_log_stream_result", - "business_id", "business", - "action", - "_document_id", - "@timestamp", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_result", "created_at", "operation_type", - "audit_log_stream_sink_details", - "request_access_security_header" + "audit_log_stream_sink_details" ] }, { @@ -207,18 +301,31 @@ "description": "An endpoint was added for audit log streaming.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "business_id", "business", - "audit_log_stream_sink", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_sink", + "created_at", + "operation_type", "audit_log_stream_id" ] }, @@ -227,15 +334,28 @@ "description": "An audit log streaming endpoint was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "business_id", "business", - "action", - "_document_id", - "@timestamp", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "audit_log_stream_id", @@ -247,17 +367,30 @@ "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "audit_log_stream_enabled", - "business_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "audit_log_stream_enabled", "audit_log_stream_sink", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "new_s3_bucket", @@ -280,21 +413,34 @@ "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -310,22 +456,34 @@ "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "uuid", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -333,25 +491,37 @@ "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", - "request_access_security_header", "old_target_amount", "old_budget_limit_type", "old_alert_enabled", @@ -365,17 +535,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -384,19 +567,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -405,15 +600,28 @@ "description": "Azure subscription has been linked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -423,15 +631,28 @@ "description": "Azure subscription has been unlinked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -441,18 +662,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", - "user", - "user_id", - "user_agent", - "created_at", - "action" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -460,16 +694,28 @@ "description": "The premium request paid usage policy for your GitHub account was changed.", "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -481,18 +727,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -500,15 +758,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -518,22 +789,31 @@ "description": "An enterprise owner was added to an enterprise.", "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", "fields": [ - "name", - "business", - "user", - "user_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "request_id", + "business", "business_id", - "_document_id", - "user_agent", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "operation_type" ], "docs_reference_titles": "Inviting people to manage your enterprise" }, @@ -542,22 +822,32 @@ "description": "An organization was added to an enterprise.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "operation_type", "name", "created_at", - "request_id", - "_document_id", - "business", - "organization_upgrade", - "request_access_security_header" + "organization_upgrade" ] }, { @@ -565,20 +855,30 @@ "description": "GitHub Advanced Security was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -587,17 +887,28 @@ "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -608,21 +919,31 @@ "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -631,17 +952,28 @@ "description": "GitHub Advanced Security was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -652,17 +984,28 @@ "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -673,21 +1016,31 @@ "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -696,20 +1049,32 @@ "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "new_policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "new_policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -718,20 +1083,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -739,17 +1116,28 @@ "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -761,21 +1149,31 @@ "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -784,18 +1182,31 @@ "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -804,17 +1215,30 @@ "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", "fields": [ - "name", - "operation_type", - "business_id", - "user_agent", - "actor_id", - "request_id", - "actor", + "@timestamp", "_document_id", - "business", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -824,19 +1248,32 @@ "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", "business_id", - "action", - "_document_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "business", "visibility", "created_at", - "actor", - "operation_type", - "@timestamp" + "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -845,21 +1282,33 @@ "description": "The policy for Code scanning autofix was updated for an enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -867,21 +1316,33 @@ "description": "The policy for Code scanning autofix third party tools was updated for an enterprise.", "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/getting-started/github-security-features#available-with-github-code-security" }, @@ -890,18 +1351,30 @@ "description": "The policy for Code Security enablement was updated for an enterprise.", "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -913,19 +1386,31 @@ "description": "An enterprise was created.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", "_document_id", "action", - "@timestamp", - "request_id", - "name", + "actor", + "actor_id", "business", "business_id", - "operation_type", - "actor", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "name", + "operation_type", + "created_at" ] }, { @@ -933,17 +1418,28 @@ "description": "Dependabot alerts were disabled for new repositories in your enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -953,17 +1449,28 @@ "description": "Dependabot alerts were enabled for new repositories in your enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -973,17 +1480,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -993,18 +1513,30 @@ "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1012,17 +1544,28 @@ "description": "Display of IP addresses within audit log events for the enterprise was disabled.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1033,18 +1576,31 @@ "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.", "docs_reference_links": "N/A", "fields": [ - "action", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "business_id", - "actor_id", - "name", - "_document_id", - "request_id" + "name" ] }, { @@ -1052,15 +1608,28 @@ "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1070,17 +1639,28 @@ "description": "Display of IP addresses within audit log events for the enterprise was enabled.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -1091,18 +1671,31 @@ "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "operation_type", - "created_at", + "actor_id", "business", "business_id", - "name", - "_document_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "name" ] }, { @@ -1110,20 +1703,31 @@ "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", "actor_id", - "@timestamp", - "request_id", "business", - "name", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "business_id", - "_document_id" + "created_at", + "name", + "operation_type" ] }, { @@ -1131,20 +1735,31 @@ "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1152,20 +1767,31 @@ "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "name", - "actor", - "operation_type", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "business", - "actor_id", - "created_at", - "action", + "user_id", "user_agent", - "request_id", - "user_id" + "name", + "operation_type", + "created_at" ] }, { @@ -1173,20 +1799,31 @@ "description": "An enterprise owner was removed from an enterprise.", "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", - "user_agent", + "actor_id", "business", "business_id", - "@timestamp", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "name", - "actor_id", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", - "user" + "user_agent", + "operation_type", + "created_at", + "name" ], "docs_reference_titles": "Inviting people to manage your enterprise" }, @@ -1195,20 +1832,31 @@ "description": "An organization was removed from an enterprise.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "business", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "business_id", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "name", - "org" + "name" ] }, { @@ -1216,18 +1864,31 @@ "description": "The slug for the enterprise URL was renamed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "name", - "business_id", - "user_agent", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", - "@timestamp", - "created_at", + "actor_id", "business", - "_document_id" + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ] }, { @@ -1235,20 +1896,31 @@ "description": "The SAML single sign-on session for a member in an enterprise was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", - "user_agent", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "actor", - "_document_id", - "actor_id", "name", - "@timestamp", - "user_id", - "action", - "created_at", - "business" + "created_at" ] }, { @@ -1256,17 +1928,28 @@ "description": "Automatic partner validation checks have been disabled at the business level", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1277,17 +1960,28 @@ "description": "Automatic partner validation checks have been enabled at the business level", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", "fields": [ - "actor", - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1298,20 +1992,30 @@ "description": "An enterprise-level custom pattern was created for secret scanning.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -1320,17 +2024,28 @@ "description": "An enterprise-level custom pattern was removed from secret scanning.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1340,20 +2055,30 @@ "description": "An enterprise-level custom pattern was published for secret scanning.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1361,17 +2086,28 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1382,20 +2118,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -1404,17 +2150,28 @@ "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1424,17 +2181,28 @@ "description": "Secret scanning was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1445,17 +2213,28 @@ "description": "Secret scanning was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1466,17 +2245,28 @@ "description": "Secret scanning was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1487,19 +2277,30 @@ "description": "Secret scanning was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" }, @@ -1508,17 +2309,28 @@ "description": "Secret scanning for non-provider patterns was disabled at the enterprise level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1530,17 +2342,28 @@ "description": "Secret scanning for non-provider patterns was enabled at the enterprise level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1552,17 +2375,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1573,17 +2407,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1594,17 +2439,28 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1615,17 +2471,28 @@ "description": "Push protection for secret scanning was disabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1636,17 +2503,28 @@ "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1657,17 +2535,28 @@ "description": "Push protection for secret scanning was enabled for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1678,17 +2567,28 @@ "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ], @@ -1699,10 +2599,28 @@ "description": "The push protection setting was updated for a secret type for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "push_protection_setting", "secret_type", "secret_type_display_name", @@ -1715,33 +2633,63 @@ "description": "The push protection pattern configuration was updated for your enterprise.", "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", "business", "business_id", - "created_at" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business.secret_scanning_repo_admin_settings_policy_update", - "description": "N/A", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at" + ], + "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" + }, + { + "action": "business.secret_scanning_repo_admin_settings_policy_update", + "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "new_policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1749,26 +2697,36 @@ "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1776,24 +2734,34 @@ "description": "A CSV export was requested on the \"Coverage\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1801,26 +2769,36 @@ "description": "A CSV export was requested on the \"Overview Dashboard\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1828,20 +2806,31 @@ "description": "A CSV export was requested on the \"Risk\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1852,17 +2841,29 @@ "description": "The cache retention policy for GitHub Actions was set for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type", "actor_is_bot" @@ -1874,17 +2875,29 @@ "description": "The cache storage policy for GitHub Actions was set for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type", "actor_is_bot" @@ -1896,17 +2909,30 @@ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "created_at", "operation_type" ], @@ -1917,20 +2943,32 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1939,19 +2977,32 @@ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "limit", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "limit", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1960,19 +3011,31 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -1981,20 +3044,32 @@ "description": "The policy for fork pull request workflows was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -2003,19 +3078,31 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -2024,20 +3111,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "issuer", - "name", - "user_agent", - "action", "@timestamp", "_document_id", + "action", "actor", + "actor_id", "business", "business_id", - "actor_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "issuer", + "name", + "created_at", + "operation_type" ] }, { @@ -2045,18 +3144,31 @@ "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "updated_github_owned_allowed", "updated_verified_allowed", "updated_patterns", @@ -2071,20 +3183,33 @@ "description": "The base repository permission setting was updated for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", "fields": [ - "business_id", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "permission", - "action", "created_at", - "@timestamp", - "request_id", "name", - "_document_id", - "old_permission", - "business" + "old_permission" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -2093,19 +3218,32 @@ "description": "The repository creation setting was updated for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation", "fields": [ - "created_at", + "@timestamp", "_document_id", - "request_id", - "name", - "business_id", + "action", "actor", "actor_id", - "@timestamp", - "operation_type", - "permission", - "action", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "name", + "operation_type", + "permission", "visibility" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -2115,19 +3253,32 @@ "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories", "fields": [ - "business_id", - "created_at", - "action", - "operation_type", "@timestamp", - "request_id", - "permission", + "_document_id", + "action", "actor", "actor_id", - "name", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "business" + "created_at", + "operation_type", + "permission", + "name" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -2136,42 +3287,64 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", - "repo_id", - "_document_id" - ], - "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" - }, - { + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" + }, + { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -2182,17 +3355,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2200,15 +3385,31 @@ "description": "Existing code scanning alerts appeared in a branch.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2218,15 +3419,31 @@ "description": "Code scanning alerts were fixed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2236,15 +3453,31 @@ "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_numbers", "commit_oid", - "ref", - "request_id", - "org_id", - "org", - "business_id", - "business" + "ref" ], "docs_reference_titles": "About code scanning" }, @@ -2253,15 +3486,29 @@ "description": "Code scanning alerts were manually dismissed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers", "dismissal_approver_id" ], @@ -2272,19 +3519,31 @@ "description": "Dismissal of code scanning alerts was approved.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2295,19 +3554,31 @@ "description": "Dismissal of code scanning alerts was denied.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2318,19 +3589,31 @@ "description": "Dismissal of code scanning alerts was requested.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2341,13 +3624,31 @@ "description": "Code scanning alerts were seen for the first time.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2357,15 +3658,31 @@ "description": "Code scanning alerts that were previously fixed reappeared.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2375,15 +3692,29 @@ "description": "Code scanning alerts that were previously dismissed were reopened.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -2393,14 +3724,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2410,25 +3756,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -2439,22 +3794,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -2466,22 +3832,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -2490,15 +3867,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -2509,17 +3901,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2529,27 +3934,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", "org", - "owner", - "pull_request_id", - "machine_type", - "user_id", - "user", - "devcontainer_path", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", - "action", - "_document_id", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "owner", + "pull_request_id", + "machine_type", + "devcontainer_path", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2557,19 +3971,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -2577,18 +4004,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -2597,23 +4036,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2621,16 +4067,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -2639,24 +4099,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2664,15 +4130,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -2682,20 +4161,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -2703,19 +4192,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -2723,21 +4224,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -2745,22 +4255,33 @@ "description": "Specific repositories were disabled from using Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "owner_type", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -2768,21 +4289,31 @@ "description": "Specific repositories were enabled to use Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "owner_type", - "owner", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2792,20 +4323,32 @@ "description": "Copilot coding agent access was updated for the organization's or user's repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_access", "old_access", - "org_id", "owner_type", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2815,21 +4358,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2839,19 +4391,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -2861,21 +4422,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2885,18 +4455,31 @@ "description": "A new custom property definition was created.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -2909,18 +4492,31 @@ "description": "A custom property definition was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -2934,14 +4530,29 @@ "description": "A custom property definition was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "value_type", @@ -2954,8 +4565,7 @@ "old_default_value", "old_value_type", "old_values_editable_by", - "values_editable_by", - "request_access_security_header" + "values_editable_by" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2964,27 +4574,35 @@ "description": "A repository's custom property value was manually set for the first time.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "definition_id", - "property_name", - "value", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "definition_id", + "property_name", + "value", + "public_repo", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -2993,19 +4611,31 @@ "description": "A repository's custom property value was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -3014,16 +4644,29 @@ "description": "A repository's custom property value was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "definition_id" @@ -3035,19 +4678,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -3056,19 +4710,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -3077,19 +4742,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -3098,19 +4774,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -3119,21 +4806,31 @@ "description": "The default repository access for Dependabot was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "access_level", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -3142,17 +4839,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -3160,40 +4870,62 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependabot_security_updates.enable", - "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "created_at", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", + "user_agent", "operation_type", + "created_at" + ], + "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + }, + { + "action": "dependabot_security_updates.enable", + "description": "Dependabot security updates were enabled for all existing repositories.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", - "_document_id" + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3201,19 +4933,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -3222,19 +4965,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -3242,19 +4996,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -3263,19 +5028,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3283,19 +5059,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -3304,20 +5091,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3325,21 +5122,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "team", - "created_at", - "user_id", "@timestamp", - "number", - "org", - "title", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", "user_agent", - "operation_type", - "_document_id" + "team", + "created_at", + "number", + "title", + "operation_type" ] }, { @@ -3347,18 +5156,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", "@timestamp", - "user_agent", - "operation_type", - "user_id", + "_document_id", + "action", "actor", - "number", - "user", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "number", + "created_at" ] }, { @@ -3366,18 +5188,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "action", - "_document_id", - "request_id", - "org", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org_id", "user_agent", - "actor", + "operation_type", "number", "team", "created_at" @@ -3388,21 +5221,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "_document_id", - "title", - "user", - "user_agent", - "org", - "operation_type", - "actor_id", "@timestamp", - "actor", - "team", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", + "title", + "operation_type", + "team", "number" ] }, @@ -3411,17 +5255,31 @@ "description": "A global announcement banner was created for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3432,16 +5290,30 @@ "description": "A global announcement banner was removed from the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3452,18 +5324,32 @@ "description": "A global announcement banner was updated for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", "old_message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -3474,23 +5360,31 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise" }, @@ -3499,19 +5393,33 @@ "description": "A domain was approved for an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3520,18 +5428,33 @@ "description": "A domain was added to an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3540,18 +5463,33 @@ "description": "A domain was removed from an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3560,18 +5498,33 @@ "description": "A domain was verified for an enterprise.", "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Verifying or approving a domain for your enterprise" }, @@ -3580,18 +5533,30 @@ "description": "A new GitHub Actions self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -3600,20 +5565,30 @@ "description": "A GitHub Actions self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -3622,20 +5597,30 @@ "description": "An enterprise role was assigned to a user or enterprise team.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "enterprise_role_id", - "enterprise_role_name", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "enterprise_role_id", + "enterprise_role_name", "created_at", "operation_type", "actor_is_bot" @@ -3647,20 +5632,32 @@ "description": "A custom enterprise role was created in an enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3672,20 +5669,32 @@ "description": "A custom enterprise role was deleted in an enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3697,20 +5706,30 @@ "description": "A user or enterprise team was unassigned an enterprise role.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "enterprise_role_id", - "enterprise_role_name", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "enterprise_role_id", + "enterprise_role_name", "created_at", "operation_type", "actor_is_bot" @@ -3722,21 +5741,33 @@ "description": "A custom enterprise role was edited in an enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", "old_role_permissions", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3748,18 +5779,31 @@ "description": "A GitHub Actions self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows" ], "docs_reference_titles": "Removing self-hosted runners" @@ -3769,40 +5813,66 @@ "description": "A GitHub Actions self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ], - "docs_reference_titles": "Managing access to self-hosted runners using groups" - }, - { - "action": "enterprise.runner_group_runner_removed", - "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", - "fields": [ - "user_agent", - "request_id", - "actor", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" + ], + "docs_reference_titles": "Managing access to self-hosted runners using groups" + }, + { + "action": "enterprise.runner_group_runner_removed", + "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.", + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -3811,19 +5881,31 @@ "description": "A GitHub Actions self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3832,19 +5914,32 @@ "description": "A GitHub Actions runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -3853,24 +5948,36 @@ "description": "The configuration of a GitHub Actions self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -3879,14 +5986,32 @@ "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -3895,14 +6020,32 @@ "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -3911,18 +6054,36 @@ "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", "target_version", "runner_group_id", "runner_group_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Self-hosted runners" }, @@ -3931,22 +6092,32 @@ "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "business_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "user", - "business", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3954,39 +6125,64 @@ "description": "A license for GitHub Copilot was assigned to an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "business_id", - "enterprise_team_id", - "enterprise_team", "business", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "actor_is_bot", - "request_access_security_header" - ] - }, - { - "action": "enterprise_team.copilot_unassignment", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "enterprise_team_id", + "enterprise_team", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, + { + "action": "enterprise_team.copilot_unassignment", "description": "A license for GitHub Copilot was unassigned from an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3997,17 +6193,30 @@ "description": "A new enterprise team was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4017,17 +6226,30 @@ "description": "An enterprise team was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -4038,22 +6260,32 @@ "description": "A member was removed from the enterprise team or an IdP group linked to an enterprise team, or an IdP group was unlinked from an enterprise team.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "business_id", + "user_agent", "enterprise_team_id", "enterprise_team", - "user", - "business", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4061,18 +6293,31 @@ "description": "The name of an enterprise team was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "business_id", "enterprise_team_id", "enterprise_team", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -4083,22 +6328,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -4107,22 +6361,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4130,28 +6394,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -4160,27 +6430,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", - "visibility", - "environment_name", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "visibility", + "environment_name", + "public_repo", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -4189,25 +6467,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -4216,26 +6502,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -4244,21 +6537,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -4267,22 +6572,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -4291,25 +6606,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -4318,22 +6642,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -4342,21 +6678,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -4367,27 +6713,33 @@ "description": "A user was added to an external group.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "external_group", - "external_group_id", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "external_group", + "external_group_id", "created_at", "operation_type", - "business", - "business_id", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -4395,19 +6747,31 @@ "description": "An external group was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at", "scim_group_id" ] }, @@ -4416,22 +6780,33 @@ "description": "An external group was linked to a GitHub team.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "external_group", - "programmatic_access_type", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -4439,21 +6814,31 @@ "description": "An external group was created.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -4461,26 +6846,32 @@ "description": "A user was removed from an external group.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "external_group", - "external_group_id", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "external_group", + "external_group_id", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -4488,15 +6879,29 @@ "description": "Failed external group SCIM API request.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", @@ -4504,15 +6909,9 @@ "url_path", "scim_group_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4521,30 +6920,38 @@ "description": "Successful external group SCIM API request. Excludes GET API requests.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", "status_code", "url_path", "scim_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4553,18 +6960,31 @@ "description": "An external group was unlinked to a GitHub team.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "external_group_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "external_group" ] }, @@ -4573,22 +6993,32 @@ "description": "An external group was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "scim_group_id", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at", + "scim_group_id" ] }, { @@ -4596,25 +7026,33 @@ "description": "An external group's display name was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", - "external_group_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "external_group_id", "external_group", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "scim_group_id", - "request_access_security_header" + "scim_group_id" ] }, { @@ -4622,20 +7060,31 @@ "description": "An external identity was deprovisioned, suspending the linked GitHub user.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -4643,17 +7092,31 @@ "description": "An external identity was created and linked to a GitHub user.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "scim_user_id", - "request_access_security_header" + "scim_user_id" ] }, { @@ -4661,15 +7124,29 @@ "description": "Failed external identity SCIM API request.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", @@ -4677,15 +7154,9 @@ "url_path", "scim_user_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4694,30 +7165,38 @@ "description": "Successful external identity SCIM API request. Excludes GET API requests.", "docs_reference_links": "/rest/scim/scim", "fields": [ - "user_agent", - "request_id", - "request_method", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", + "request_method", "query_string", "api_request_body", "route", "status_code", "url_path", "scim_user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "REST API endpoints for SCIM" }, @@ -4726,18 +7205,31 @@ "description": "An external identity was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "scim_user_id", - "request_access_security_header" + "scim_user_id" ] }, { @@ -4745,21 +7237,32 @@ "description": "A gist was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "gist_id", - "@timestamp", "created_at", "operation_type", - "user_agent", - "actor", - "actor_id", - "visibility", - "action", - "_document_id", - "token_scopes", - "programmatic_access_type" + "visibility" ] }, { @@ -4767,20 +7270,32 @@ "description": "A gist was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "gist_id", - "visibility", - "created_at", + "@timestamp", "_document_id", - "user", - "request_id", - "operation_type", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "@timestamp", - "programmatic_access_type" + "gist_id", + "visibility", + "created_at", + "operation_type" ] }, { @@ -4788,41 +7303,63 @@ "description": "The visibility of a gist was updated.", "docs_reference_links": "N/A", "fields": [ - "action", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", - "user", - "gist_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "visibility", - "user_id", - "created_at", - "_document_id", + "token_id", "token_scopes", - "programmatic_access_type" - ] - }, + "user", + "user_id", + "user_agent", + "operation_type", + "gist_id", + "visibility", + "created_at" + ] + }, { "action": "git.clone", "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4831,20 +7368,30 @@ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4853,19 +7400,30 @@ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -4874,22 +7432,33 @@ "description": "An SSH key was added to a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -4898,23 +7467,34 @@ "description": "An SSH key was removed from a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", "explanation", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -4923,23 +7503,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4947,18 +7536,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -4969,20 +7568,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -4992,18 +7601,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "created_at", - "user_id", "@timestamp", - "user", - "operation_type", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -5011,18 +7632,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "action", - "created_at", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "@timestamp", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -5030,25 +7663,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -5056,25 +7699,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -5082,26 +7734,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -5110,25 +7771,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -5136,26 +7806,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -5163,21 +7842,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -5186,19 +7876,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -5206,42 +7909,67 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "application_client_id" - ] - }, - { - "action": "integration_installation.create", - "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", - "fields": [ + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", "operation_type", + "created_at", + "application_client_id" + ] + }, + { + "action": "integration_installation.create", + "description": "A GitHub App was installed.", + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -5252,20 +7980,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -5275,24 +8015,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -5303,23 +8054,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -5330,21 +8093,33 @@ "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", "operation_type", - "@timestamp", "integration", - "action", - "user_agent", "reason", - "_document_id", - "org", - "org_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -5355,20 +8130,32 @@ "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ "@timestamp", - "actor_id", - "org", "_document_id", - "requester", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "requester", "created_at", "url", - "org_id", - "request_id", "operation_type", - "actor", "integration", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -5378,20 +8165,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -5401,19 +8201,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -5422,20 +8236,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", - "user_id", - "user_agent", - "name", - "user", - "operation_type", - "actor_id", - "action", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "integration", + "name", + "operation_type", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -5445,20 +8272,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -5467,20 +8307,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -5489,20 +8342,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -5510,19 +8375,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -5531,19 +8409,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -5552,17 +8443,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -5575,21 +8479,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -5603,17 +8520,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -5625,39 +8555,61 @@ "description": "An IP allow list was disabled.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "actor", - "request_id", - "org", - "user_agent", + "@timestamp", "_document_id", - "user_id", - "actor_id", - "created_at", - "org_id", "action", - "@timestamp", - "user" - ] + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] }, { "action": "ip_allow_list.disable_for_installed_apps", "description": "An IP allow list was disabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5665,17 +8617,28 @@ "description": "IP allow list user level enforcement was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5685,20 +8648,29 @@ "description": "An IP allow list was enabled.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "user_id", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "business_id", - "_document_id", - "action", - "@timestamp", + "user_id", "user_agent", - "actor_id", "operation_type", - "org", "created_at" ] }, @@ -5707,19 +8679,30 @@ "description": "An IP allow list was enabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5727,17 +8710,28 @@ "description": "IP allow list user level enforcement was enabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5747,24 +8741,32 @@ "description": "An IP address was added to an IP allow list.", "docs_reference_links": "N/A", "fields": [ - "active", - "org", - "ip_allow_list_entry", "@timestamp", "_document_id", - "operation_type", - "created_at", - "user_agent", "action", - "request_id", + "actor", "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "business", - "actor", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", + "ip_allow_list_entry", + "operation_type", + "created_at" ] }, { @@ -5772,24 +8774,32 @@ "description": "An IP address was deleted from an IP allow list.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "ip_allow_list_entry", - "org", - "operation_type", - "created_at", - "active", "action", - "@timestamp", + "actor", + "actor_id", "business", "business_id", - "user_agent", + "hashed_token", + "org", "org_id", - "actor", - "actor_id", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ip_allow_list_entry", + "operation_type", + "created_at", + "active" ] }, { @@ -5797,19 +8807,32 @@ "description": "An IP address or its description was changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "actor_id", "ip_allow_list_entry", - "active", - "org_id", - "@timestamp" + "active" ] }, { @@ -5817,21 +8840,31 @@ "description": "An issue was marked as blocked by another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", + "public_repo", + "created_at", "operation_type", "actor_is_bot" ] @@ -5841,19 +8874,30 @@ "description": "The blocked by relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5863,20 +8907,30 @@ "description": "An issue was marked as blocking another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -5887,20 +8941,30 @@ "description": "The blocking relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -5911,18 +8975,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -5930,21 +9006,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -5952,21 +9041,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -5974,22 +9076,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -5997,19 +9112,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -6020,44 +9148,74 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "actor", + "_document_id", "action", - "operation_type", - "marketplace_listing", - "has_free_trial", - "user_agent", - "request_id", + "actor", "actor_id", - "yearly_price_in_cents", - "description", - "bullets", - "monthly_price_in_cents", - "marketplace_listing_plan", - "_document_id" - ] - }, - { - "action": "marketplace_listing_plan.publish", - "description": "N/A", - "docs_reference_links": "N/A", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "marketplace_listing", + "has_free_trial", + "yearly_price_in_cents", + "description", + "bullets", + "monthly_price_in_cents", + "marketplace_listing_plan" + ] + }, + { + "action": "marketplace_listing_plan.publish", + "description": "N/A", + "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "marketplace_listing_plan", "marketplace_listing", "description", "bullets", "has_free_trial", "created_at", - "actor_id", "operation_type", - "_document_id", - "action", - "user_agent", - "request_id", - "actor", "monthly_price_in_cents", - "yearly_price_in_cents", - "@timestamp" + "yearly_price_in_cents" ] }, { @@ -6065,21 +9223,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor", - "marketplace_listing_plan", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "marketplace_listing_plan", "description", "yearly_price_in_cents", - "@timestamp", "created_at", - "actor_id", "bullets", "has_free_trial", "marketplace_listing", - "user_agent", "monthly_price_in_cents", - "action", "operation_type" ] }, @@ -6088,21 +9261,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "monthly_price_in_cents", - "marketplace_listing", + "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "monthly_price_in_cents", + "marketplace_listing", "description", "bullets", "yearly_price_in_cents", - "request_id", - "actor_id", "has_free_trial", "marketplace_listing_plan", - "user_agent", - "@timestamp", "operation_type", - "actor", "created_at" ] }, @@ -6111,22 +9299,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -6134,22 +9335,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6157,19 +9371,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -6177,21 +9403,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6201,16 +9436,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6220,18 +9468,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ - "actor", - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6241,14 +9502,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -6256,19 +9533,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -6276,18 +9564,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6295,23 +9595,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -6319,20 +9627,30 @@ "description": "An OAuth access token was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", "fields": [ - "_document_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "user", - "user_id", - "created_at", + "_document_id", "action", + "actor", "actor_id", - "request_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" @@ -6343,19 +9661,30 @@ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", "fields": [ "@timestamp", - "user_agent", - "action", - "operation_type", "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_id", + "user_agent", + "operation_type", + "created_at", "explanation", - "hashed_token", - "actor_id", - "token_scopes", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" @@ -6365,19 +9694,30 @@ "description": "An OAuth access token was regenerated.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "_document_id", - "created_at", "@timestamp", - "operation_type", + "_document_id", "action", - "user_agent", - "request_id", "actor", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "oauth_application_name" ] }, @@ -6386,16 +9726,28 @@ "description": "An OAuth access token was revoked.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "request_access_security_header", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -6405,39 +9757,63 @@ "description": "An OAuth access token was updated.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", "action", - "@timestamp", - "user", - "user_agent", - "request_access_security_header" - ] - }, - { - "action": "oauth_application.create", - "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "org", - "created_at", - "oauth_application_id", - "operation_type", - "user_agent", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "actor", - "oauth_application", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "oauth_application.create", + "description": "An OAuth application was created.", + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6446,20 +9822,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6468,20 +9856,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6490,20 +9890,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6512,19 +9924,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6533,20 +9958,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6555,20 +9992,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6578,18 +10027,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user_agent", - "org_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "oauth_application_id", - "action", "created_at", - "actor", - "actor_id", - "oauth_application", - "_document_id", - "request_id" + "oauth_application" ] }, { @@ -6597,19 +10059,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", "actor_id", - "oauth_application_id", - "@timestamp", - "user_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6618,15 +10093,32 @@ "description": "An OAuth application was unsuspended for a user or organization account.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "operation_type", - "org_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "oauth_application_id", "oauth_application", - "org", - "created_at", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -6635,24 +10127,31 @@ "description": "An authorization for an OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ - "operation_type", - "user_agent", - "user_id", - "actor", - "org_id", + "@timestamp", "_document_id", - "request_id", "action", - "@timestamp", - "created_at", + "actor", "actor_id", - "user", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_is_bot", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -6662,20 +10161,31 @@ "description": "An authorization for an OAuth application was deleted.", "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", "fields": [ - "user_agent", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "actor", "created_at", "explanation", - "user", - "user_id", - "org_id", - "action", - "actor_id", - "token_scopes", "actor_is_bot", "oauth_application_name" ], @@ -6686,20 +10196,31 @@ "description": "An authorization for an OAuth application was updated.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", - "actor_id", "user_agent", - "@timestamp", "operation_type", - "action", - "user", "created_at", - "_document_id", "actor_is_bot", - "request_access_security_header", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -6709,17 +10230,28 @@ "description": "An invitation sent to an organization to join an enterprise was accepted.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6730,20 +10262,30 @@ "description": "A billing manager was added to an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "org", - "user_id", "action", - "created_at", - "org_id", - "user", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" }, @@ -6752,21 +10294,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -6775,24 +10327,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -6800,42 +10362,62 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", - "org", - "team", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "programmatic_access_type" - ] + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -6843,22 +10425,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -6866,20 +10456,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -6887,22 +10487,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -6910,21 +10518,31 @@ "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "new_policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "new_policy", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -6934,19 +10552,30 @@ "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -6955,19 +10584,30 @@ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -6977,16 +10617,29 @@ "description": "A user initiated a background job to delete an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "@timestamp", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "created_at" ] }, @@ -6995,16 +10648,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_agent", - "action", "@timestamp", - "actor_id", - "org_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -7013,18 +10679,31 @@ "description": "An organization owner blocked a user from accessing the organization's repositories.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", "fields": [ - "actor", - "user_agent", - "org_id", - "created_at", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "blocked_user", + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" }, @@ -7033,19 +10712,30 @@ "description": "An invitation for an organization to join an enterprise was revoked", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "initiated_from" ], "docs_reference_titles": "Adding organizations to your enterprise" @@ -7055,22 +10745,33 @@ "description": "An invitation sent to a user to join an organization was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "email", - "@timestamp", - "actor", - "action", "operation_type", - "user_agent", - "org", "invitation_id", - "_document_id", "created_at", - "invitee_email", - "token_scopes", - "programmatic_access_type" + "invitee_email" ] }, { @@ -7078,19 +10779,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -7098,23 +10810,31 @@ "description": "Autofix for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7122,21 +10842,31 @@ "description": "Autofix for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7144,23 +10874,31 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7168,23 +10906,31 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7192,21 +10938,30 @@ "description": "Code scanning using the default setup was disabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -7215,21 +10970,30 @@ "description": "Code scanning using the default setup was enabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -7238,16 +11002,29 @@ "description": "The interaction limit for collaborators only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "request_id", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" @@ -7257,17 +11034,30 @@ "description": "The interaction limit for prior contributors only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "operation_type", "@timestamp", - "created_at", - "user_agent", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", - "actor", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -7276,17 +11066,30 @@ "description": "The interaction limit for existing users only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", "_document_id", - "operation_type", - "actor_id", - "org_id", "action", - "created_at", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -7296,16 +11099,29 @@ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ "@timestamp", - "created_at", "_document_id", - "actor_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "action", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -7314,17 +11130,30 @@ "description": "The interaction limit for prior contributors only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "operation_type", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -7333,17 +11162,30 @@ "description": "The interaction limit for existing users only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "actor_id", - "request_id", + "@timestamp", + "_document_id", "action", - "created_at", - "user_agent", "actor", - "_document_id", - "org_id", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -7352,22 +11194,30 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" }, @@ -7376,17 +11226,28 @@ "description": "An invitation for an organization to join an enterprise was confirmed.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -7397,18 +11258,30 @@ "description": "An organization was created.", "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", "fields": [ - "request_id", - "org", - "actor_id", - "actor", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "org_id", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" }, @@ -7417,39 +11290,61 @@ "description": "An organization was deleted by a user or staff.", "docs_reference_links": "N/A", "fields": [ - "user_agent", "@timestamp", "_document_id", - "created_at", - "actor", - "org_id", - "org", "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" - ] + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] }, { "action": "org.disable_member_team_creation_permission", "description": "Team creation was limited to owners.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "actor", "@timestamp", "_document_id", - "user", - "user_id", "action", - "created_at", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -7458,19 +11353,30 @@ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -7479,14 +11385,31 @@ "description": "SAML single sign-on was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sso_url", "issuer", - "action", - "@timestamp", - "_document_id", "created_at", - "org", "operation_type" ] }, @@ -7495,17 +11418,30 @@ "description": "A two-factor authentication requirement was disabled for the organization.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "org_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "_document_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7513,19 +11449,30 @@ "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "user", - "action", - "operation_type", "@timestamp", "_document_id", - "created_at", - "user_agent", - "org", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7533,19 +11480,30 @@ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "user", - "action", - "actor_id", - "org_id" + "created_at" ] }, { @@ -7553,19 +11511,30 @@ "description": "Team creation by members was allowed.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "org_id", - "user", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -7574,19 +11543,30 @@ "description": "An organization owner allowed users with read access to create discussions in an organization", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -7595,19 +11575,32 @@ "description": "SAML single sign-on was enabled for the organization.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", - "sso_url", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "@timestamp", - "issuer", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "sso_url", + "created_at", + "issuer" ], "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" }, @@ -7616,36 +11609,62 @@ "description": "Two-factor authentication is now required for the organization.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "actor_id", - "action", - "_document_id", - "org", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "created_at", - "request_id" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" - }, + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], + "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + }, { "action": "org.integration_manager_added", "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "org_id", - "manager", "@timestamp", - "request_id", - "actor", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "manager", + "operation_type", "created_at" ] }, @@ -7654,18 +11673,31 @@ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", "docs_reference_links": "N/A", "fields": [ - "org_id", "@timestamp", - "org", - "user_agent", - "request_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "manager", "operation_type", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7673,23 +11705,32 @@ "description": "A new user was invited to join an organization.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", "fields": [ - "org", - "user_id", - "invitation_id", - "org_id", - "user", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", - "created_at", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "invitee_email", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitation_id", + "operation_type", + "created_at", + "invitee_email" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" }, @@ -7698,17 +11739,28 @@ "description": "An organization was invited to join an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7718,19 +11770,30 @@ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7738,19 +11801,30 @@ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "org", - "org_id", - "user_agent", - "actor_id", - "user_id", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7759,16 +11833,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "org_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type", - "_document_id", - "org" + "created_at", + "operation_type" ] }, { @@ -7776,17 +11863,30 @@ "description": "An organization was restored.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "org_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7794,19 +11894,31 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", "fields": [ - "actor", - "operation_type", "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "actor_is_bot", - "request_access_security_header" + "operation_type", + "created_at", + "actor_is_bot" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -7815,18 +11927,29 @@ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "user_id", - "user_agent", - "org_id", - "user", - "action", - "_document_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" @@ -7836,21 +11959,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7858,21 +11990,30 @@ "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ - "org", - "user", - "org_id", - "created_at", - "request_id", "@timestamp", - "action", - "operation_type", - "user_agent", "_document_id", + "action", "actor", "actor_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7880,21 +12021,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -7902,18 +12053,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", "fields": [ - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "actor", - "action", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -7922,19 +12085,31 @@ "description": "An organization was renamed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "_document_id", "@timestamp", - "org", + "_document_id", "action", "actor", - "old_login", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_login", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -7942,20 +12117,30 @@ "description": "An organization member was restored.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", "fields": [ - "user", - "actor", - "user_id", + "@timestamp", "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "actor_id", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" }, @@ -7964,21 +12149,33 @@ "description": "A self-hosted runner group was created.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" @@ -7988,21 +12185,31 @@ "description": "A self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -8011,23 +12218,33 @@ "description": "The REST API was used to remove a self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", - "runner_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", + "runner_id", + "operation_type", + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -8036,23 +12253,31 @@ "description": "A self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -8061,19 +12286,32 @@ "description": "A runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -8082,25 +12320,36 @@ "description": "The configuration of a self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -8109,21 +12358,30 @@ "description": "Automatic partner validation checks have been disabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -8133,21 +12391,30 @@ "description": "Automatic partner validation checks have been enabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -8157,20 +12424,30 @@ "description": "A custom pattern was created for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -8179,22 +12456,30 @@ "description": "A custom pattern was removed from secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -8203,21 +12488,30 @@ "description": "A custom pattern was published for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -8226,21 +12520,30 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "business", - "business_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -8249,22 +12552,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -8273,21 +12584,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -8296,21 +12616,30 @@ "description": "Secret scanning for non-provider patterns was disabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -8320,21 +12649,30 @@ "description": "Secret scanning for non-provider patterns was enabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -8344,19 +12682,30 @@ "description": "A role or team was added to the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -8366,21 +12715,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -8390,21 +12748,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -8414,19 +12781,30 @@ "description": "A role or team was removed from the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -8436,22 +12814,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8460,22 +12846,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8484,22 +12878,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8508,21 +12910,30 @@ "description": "Push protection for secret scanning was disabled.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8531,21 +12942,30 @@ "description": "Push protection for secret scanning was enabled.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8554,22 +12974,30 @@ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8578,22 +13006,30 @@ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -8602,12 +13038,28 @@ "description": "The push protection setting was updated for a secret type for your organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "push_protection_setting", "secret_type", "secret_type_display_name", @@ -8620,12 +13072,28 @@ "description": "The push protection pattern configuration was updated for your organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at" ], "docs_reference_titles": "About push protection" @@ -8635,26 +13103,35 @@ "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -8663,26 +13140,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8690,28 +13175,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8719,26 +13212,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8746,15 +13247,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -8763,15 +13281,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -8780,7 +13315,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -8795,18 +13351,28 @@ "description": "The cache retention policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -8818,18 +13384,28 @@ "description": "The cache storage policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -8841,20 +13417,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -8863,16 +13450,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -8883,18 +13483,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -8903,17 +13516,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", "_document_id", - "org_id", - "operation_type", + "action", "actor", "actor_id", - "@timestamp", - "request_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", - "action" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8921,18 +13547,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -8941,18 +13579,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -8961,18 +13612,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -8981,22 +13644,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", "actor_id", - "org_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issuer", - "business", "operation_type", "created_at", - "request_id", - "business_id", - "_document_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9004,19 +13677,31 @@ "description": "A user account was converted into an organization.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization", "fields": [ - "actor", + "@timestamp", "_document_id", - "request_id", - "operation_type", + "action", + "actor", "actor_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "@timestamp", - "created_at", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "owner", - "request_access_security_header" + "operation_type", + "created_at", + "owner" ], "docs_reference_titles": "Converting a user into an organization" }, @@ -9025,19 +13710,32 @@ "description": "A user was unblocked from an organization.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", "fields": [ - "oauth_application_id", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", - "@timestamp", - "request_id", - "created_at", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "blocked_user", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" }, @@ -9046,23 +13744,34 @@ "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "updated_allowed_types", "old_policy", - "updated_access_policy", - "programmatic_access_type", - "request_access_security_header" + "updated_access_policy" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" }, @@ -9071,20 +13780,32 @@ "description": "The default repository permission level for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", + "created_at", "permission", - "actor_id", - "old_permission", - "_document_id", - "programmatic_access_type" + "old_permission" ] }, { @@ -9093,38 +13814,62 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", - "actor_id", - "old_permission", - "permission", - "actor", - "user_agent", - "operation_type", - "org" - ] - }, - { - "action": "org.update_member_repository_creation_permission", - "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A", - "fields": [ "actor", - "action", - "@timestamp", - "request_id", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_permission", + "permission", + "operation_type" + ] + }, + { + "action": "org.update_member_repository_creation_permission", + "description": "The create repository permission for organization members was changed.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -9134,20 +13879,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -9156,19 +13912,32 @@ "description": "An organization's SAML provider settings were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "sso_url", - "actor_id", - "operation_type", "@timestamp", - "issuer", - "org", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "operation_type", + "issuer", + "created_at" ] }, { @@ -9176,18 +13945,30 @@ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", "fields": [ - "request_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "_document_id", - "org", - "action", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" }, @@ -9196,11 +13977,28 @@ "description": "A new organization custom property definition was created.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "description", @@ -9208,11 +14006,6 @@ "required", "allowed_values", "default_value", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -9224,11 +14017,28 @@ "description": "An organization custom property definition was deleted.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "description", @@ -9236,11 +14046,6 @@ "required", "allowed_values", "default_value", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -9252,20 +14057,32 @@ "description": "An organization custom property definition was updated.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "old_values_editable_by", "values_editable_by", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -9280,21 +14097,31 @@ "description": "An organization's custom property value was manually set for the first time.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -9306,23 +14133,33 @@ "description": "An organization's custom property value was deleted.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "definition_id", - "property_name", - "value", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "definition_id", + "property_name", + "value", + "created_at", + "operation_type", "actor_is_bot" ], "docs_reference_titles": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise" @@ -9332,20 +14169,33 @@ "description": "A domain was approved for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "org_id", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" }, @@ -9354,16 +14204,31 @@ "description": "A domain was added to an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "created_at", + "@timestamp", "_document_id", - "domain_name", "action", - "request_id", + "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "domain_name", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -9372,14 +14237,29 @@ "description": "A domain was removed from an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", "fields": [ - "action", - "domain_name", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "domain_name", "operation_type", "created_at" ], @@ -9390,16 +14270,31 @@ "description": "A domain was verified for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "operation_type", - "domain_name", "@timestamp", - "user_agent", - "request_id", - "actor", - "action", - "created_at", "_document_id", - "actor_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "domain_name", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -9408,20 +14303,31 @@ "description": "An entire package was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" @@ -9431,23 +14337,34 @@ "description": "A package was published or republished to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "ecosystem", "version_count", "is_republished", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -9456,21 +14373,32 @@ "description": "A specific package version was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "version", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "ecosystem", "actor_is_bot" ], @@ -9481,21 +14409,34 @@ "description": "A specific package version was published or republished to a package.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "ecosystem", "package", "version", - "actor_id", - "user_agent", "is_republished", - "actor", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -9504,20 +14445,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -9526,17 +14481,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9547,20 +14517,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -9569,19 +14553,31 @@ "description": "A new passkey was added.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9589,19 +14585,31 @@ "description": "A new passkey was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9609,18 +14617,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9628,16 +14648,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -9645,18 +14679,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -9664,18 +14710,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9686,22 +14745,31 @@ "description": "The configured restriction for access to resources via personal access tokens was disabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9709,22 +14777,31 @@ "description": "The configured restriction for access to resources via personal access tokens was enabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9732,18 +14809,28 @@ "description": "The configured restriction for access to resources via personal access tokens was reset and delegated to organizations.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9754,18 +14841,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9776,18 +14876,28 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9798,18 +14908,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9820,18 +14940,28 @@ "description": "Triggered when the enterprise delegates to the organizations when to require approval for fine-grained personal access tokens before the tokens can access organization resources.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9842,17 +14972,30 @@ "description": "Triggered when you create a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9862,19 +15005,31 @@ "description": "Triggered when you regenerate a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9882,12 +15037,29 @@ "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", "fields": [ - "user_programmatic_access_name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", "operation_type" ], @@ -9898,20 +15070,32 @@ "description": "Triggered when you delete a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "explanation", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9919,23 +15103,34 @@ "description": "A personal access token expiration limit was set.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "token_expiration", "old_token_expiration", "exempt_administrators", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9943,21 +15138,32 @@ "description": "A personal access token expiration limit was unset.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "programmatic_access_type", - "old_token_expiration", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_token_expiration", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9965,17 +15171,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9986,18 +15205,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -10009,17 +15241,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -10031,17 +15276,30 @@ "description": "A fine-grained personal access token was updated.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -10052,15 +15310,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -10070,17 +15343,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -10090,15 +15374,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -10108,17 +15407,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -10128,17 +15438,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -10148,17 +15469,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor", - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -10168,17 +15500,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -10188,17 +15531,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -10208,17 +15564,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -10226,20 +15595,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -10249,25 +15629,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -10275,20 +15667,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -10296,25 +15700,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -10322,17 +15738,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -10340,36 +15769,61 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "action", - "actor_id", - "operation_type", - "actor", - "user_id", "@timestamp", - "created_at", "_document_id", - "user_agent", - "user" - ] - }, - { - "action": "project_field.create", - "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", - "fields": [ - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "project_field.create", + "description": "A field was created in a project board.", + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -10378,18 +15832,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -10398,19 +15864,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -10418,17 +15895,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -10440,22 +15930,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -10463,19 +15962,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -10483,17 +15993,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -10501,18 +16024,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -10520,39 +16056,61 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", - "actor", - "created_at", - "org", "_document_id", - "org_id", "action", - "programmatic_access_type" - ] - }, - { - "action": "project_view.create", - "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", - "fields": [ - "user_agent", - "request_id", "actor", "actor_id", - "org", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "project_view.create", + "description": "A view was created in a project board.", + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -10561,18 +16119,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -10581,16 +16151,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -10602,21 +16185,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -10624,22 +16219,32 @@ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", "fields": [ - "repo", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "name", "created_at", - "_document_id", "operation_type", - "actor", - "repo_id", - "org", - "request_id", - "actor_id", - "oauth_application_id", - "@timestamp", - "programmatic_access_type" + "oauth_application_id" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" }, @@ -10648,29 +16253,34 @@ "description": "A protected branch allowance was given to a specific user, team or integration.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "authorized_actors", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -10678,24 +16288,32 @@ "description": "Branch protection was enabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "repo_id", - "user_id", "@timestamp", - "user_agent", - "repo", - "name", - "org_id", - "user", "_document_id", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", "created_at", "authorized_actor_names", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -10706,21 +16324,31 @@ "description": "Branch protection was disabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "repo", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", - "request_id", - "repo_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "name", + "operation_type", "created_at", - "_document_id", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -10731,22 +16359,32 @@ "description": "Enforcement of dismissing stale pull requests was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "dismiss_stale_reviews_on_push", - "org_id", - "action", - "created_at", - "request_id", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismiss_stale_reviews_on_push", + "created_at", "operation_type", - "actor", - "repo", - "org", - "name", - "programmatic_access_type" + "name" ] }, { @@ -10754,24 +16392,34 @@ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "authorized_actors_only", "authorized_actors", "created_at", - "user_agent", "name", - "_document_id", - "org_id", - "request_id", - "@timestamp", - "actor_id", - "org", - "action", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -10779,30 +16427,37 @@ "description": "A branch protection requirement was overridden by a repository administrator.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "actor", "reasons", - "@timestamp", "before", "after", - "actor_id", - "repo", "operation_type", - "user_agent", "branch", "overridden_codes", - "org", - "org_id", - "action", - "_document_id", - "request_id", "referrer", - "business", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "rule_suite_id" ] @@ -10812,28 +16467,36 @@ "description": "A branch update attempt was rejected.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "request_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "branch", "before", "overridden_codes", "after", - "action", "reasons", - "actor_id", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "actor_is_bot", "rule_suite_id" @@ -10844,23 +16507,32 @@ "description": "Branch protection was enforced for repository administrators.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "admin_enforced", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "name", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "action", "repo_id", - "org_id", - "_document_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "admin_enforced", + "operation_type", + "name", + "created_at" ] }, { @@ -10868,22 +16540,32 @@ "description": "Branch deletion was enabled or disabled for a protected branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "operation_type", - "request_id", - "repo", "@timestamp", - "org_id", - "org", - "action", - "allow_deletions_enforcement_level", "_document_id", - "created_at", - "actor_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_deletions_enforcement_level", + "created_at" ] }, { @@ -10891,23 +16573,32 @@ "description": "Force pushes were enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "actor_id", - "name", + "@timestamp", "_document_id", + "action", "actor", - "repo", - "operation_type", - "request_id", - "allow_force_pushes_enforcement_level", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_force_pushes_enforcement_level", + "created_at" ] }, { @@ -10915,24 +16606,33 @@ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "ignore_approvals_from_contributors", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -10941,22 +16641,32 @@ "description": "Required linear commit history was enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "operation_type", "actor", - "linear_history_requirement_enforcement_level", - "repo", - "request_id", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", "repo_id", - "org", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "linear_history_requirement_enforcement_level", + "name", + "created_at" ] }, { @@ -10964,24 +16674,33 @@ "description": "Fork syncing was enabled or disabled for a read-only branch", "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "lock_allows_fetch_and_merge", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -10990,27 +16709,34 @@ "description": "The enforcement of a branch lock was updated.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "enforcement_level", "lock_branch_enforcement_level", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -11019,18 +16745,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -11041,24 +16780,33 @@ "description": "A branch name pattern was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "old_name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "old_name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -11066,25 +16814,32 @@ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", "docs_reference_links": "N/A", "fields": [ - "name", - "org_id", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "@timestamp", + "business", "business_id", - "request_id", - "pull_request_reviews_enforcement_level", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "business", - "user_agent", - "created_at", "repo_id", - "operation_type", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "pull_request_reviews_enforcement_level", + "created_at", + "operation_type" ] }, { @@ -11092,22 +16847,32 @@ "description": "Enforcement of required code owner review was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "created_at", - "require_code_owner_review", - "operation_type", - "name", - "user_agent", - "action", "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "request_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "require_code_owner_review", + "operation_type", + "name" ] }, { @@ -11115,22 +16880,33 @@ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "require_last_push_approval", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" }, @@ -11139,22 +16915,32 @@ "description": "Enforcement of the required number of approvals before merging was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "required_approving_review_count", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "required_approving_review_count", "created_at", - "actor", "operation_type", - "user_agent", - "name", - "org_id", - "action", - "actor_id", - "_document_id", - "org", - "@timestamp", - "programmatic_access_type" + "name" ] }, { @@ -11162,25 +16948,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "user_agent", "@timestamp", "_document_id", - "name", - "repo", "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "business", - "actor_id", - "operation_type", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "required_status_checks_enforcement_level", - "org", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "required_status_checks_enforcement_level" ] }, { @@ -11188,22 +16981,32 @@ "description": "Enforcement of required commit signing was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "name", "@timestamp", - "created_at", "_document_id", - "request_id", - "repo_id", - "org", - "org_id", "action", "actor", "actor_id", - "signature_requirement_enforcement_level", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "programmatic_access_type" + "operation_type", + "name", + "created_at", + "signature_requirement_enforcement_level" ] }, { @@ -11211,22 +17014,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "created_at", - "repo_id", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "name", - "actor", - "repo", "operation_type", - "action", - "strict_required_status_checks_policy", - "programmatic_access_type" + "strict_required_status_checks_policy" ] }, { @@ -11234,23 +17047,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -11259,24 +17083,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -11285,20 +17120,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -11307,21 +17156,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -11331,22 +17193,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -11355,25 +17229,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", - "actor", - "key", - "fingerprint", "@timestamp", - "request_id", - "actor_id", - "oauth_application_id", - "title", + "_document_id", "action", - "user_agent", - "created_at", - "repo", - "read_only", - "operation_type", - "_document_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "programmatic_access_type" + "user_agent", + "key", + "fingerprint", + "oauth_application_id", + "title", + "created_at", + "read_only", + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -11382,23 +17266,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", "key", "fingerprint", - "actor_id", - "actor", "title", - "user_agent", - "user_id", - "request_id", - "read_only", - "token_scopes", - "programmatic_access_type" + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -11407,18 +17302,32 @@ "description": "A pull request was closed without being merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" @@ -11428,21 +17337,32 @@ "description": "A pull request was converted to a draft.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" }, @@ -11451,19 +17371,32 @@ "description": "A pull request was created.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -11474,23 +17407,35 @@ "description": "A review was requested on a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -11500,17 +17445,31 @@ "description": "A pull request was marked as in progress.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11518,19 +17477,32 @@ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -11538,19 +17510,32 @@ "description": "A pull request was merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" @@ -11560,21 +17545,32 @@ "description": "A pull request was marked as ready for review.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", - "pull_request_url", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", + "operation_type", + "created_at", + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" }, @@ -11583,27 +17579,34 @@ "description": "A pull request was rebased.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "pull_request_url", "pull_request_title", - "user", - "user_id", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -11611,23 +17614,35 @@ "description": "A review request was removed from a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" }, @@ -11636,18 +17651,32 @@ "description": "A pull request was reopened after previously being closed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -11655,19 +17684,31 @@ "description": "A review comment was added to a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "comment_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -11677,20 +17718,31 @@ "description": "A review comment on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", "@timestamp", "_document_id", - "repo", - "created_at", - "request_id", - "comment_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "comment_id", + "operation_type" ] }, { @@ -11698,18 +17750,31 @@ "description": "A review comment on a pull request was changed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "request_id", - "actor_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "_document_id", - "@timestamp", - "comment_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "comment_id" ] }, { @@ -11717,21 +17782,33 @@ "description": "A review on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ] }, { @@ -11739,20 +17816,33 @@ "description": "A review on a pull request was dismissed.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" }, @@ -11761,19 +17851,33 @@ "description": "A review on a pull request was submitted.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "pull_request_id", - "review_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", - "pull_request_url", - "programmatic_access_type", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", + "review_id", + "operation_type", + "created_at", + "pull_request_url", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" @@ -11783,22 +17887,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -11807,21 +17921,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -11830,25 +17953,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -11857,23 +17987,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -11882,24 +18020,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -11908,23 +18053,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -11934,22 +18087,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -11958,19 +18120,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -11979,24 +18154,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", - "org", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -12005,24 +18190,32 @@ "description": "Autofix for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -12030,24 +18223,32 @@ "description": "Autofix for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -12055,24 +18256,32 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -12080,24 +18289,32 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -12105,23 +18322,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -12132,17 +18358,29 @@ "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -12152,17 +18390,29 @@ "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -12172,25 +18422,31 @@ "description": "Code scanning using the default setup was disabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -12199,26 +18455,34 @@ "description": "Code scanning using the default setup was enabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "public_repo", "created_at", "operation_type", - "business", - "business_id", "query_suite", "threat_model", - "languages", - "request_access_security_header" + "languages" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -12227,25 +18491,34 @@ "description": "Code scanning using the default setup was updated for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "query_suite", "threat_model", "languages", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Configuring default setup for code scanning" @@ -12255,20 +18528,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "visibility", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -12276,17 +18560,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -12295,15 +18592,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -12314,16 +18624,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -12333,17 +18656,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -12353,19 +18689,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -12374,17 +18721,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -12393,26 +18753,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -12421,30 +18787,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -12454,20 +18825,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12476,25 +18858,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12503,23 +18893,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -12527,25 +18928,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -12555,17 +18965,30 @@ "description": "A repository was archived on disk.", "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories", "fields": [ - "actor_id", - "repo", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", - "repo_id", - "actor", "action", - "user_agent" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/archiving-a-github-repository/archiving-repositories" }, @@ -12574,23 +18997,32 @@ "description": "A source code archive of a repository was downloaded as a ZIP file.", "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "created_at", "operation_type", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" @@ -12600,20 +19032,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "visibility", - "repo_id", - "created_at", - "actor", - "action", - "@timestamp", "org_id", - "request_id", + "programmatic_access_type", "repo", - "_document_id" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "visibility", + "created_at" ] }, { @@ -12621,20 +19064,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "visibility", - "repo_id", - "request_id", - "action", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "user", - "operation_type", - "actor", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", "public_repo" ] }, @@ -12643,19 +19097,30 @@ "description": "The repository was unlocked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -12663,20 +19128,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "action", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "operation_type", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "visibility", - "actor", - "user_id" + "visibility" ] }, { @@ -12684,23 +19160,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -12708,21 +19194,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -12730,21 +19226,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -12752,22 +19258,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -12775,21 +19290,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -12797,20 +19322,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -12818,22 +19354,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -12841,18 +19386,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -12860,22 +19419,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -12883,21 +19452,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -12905,18 +19484,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -12925,22 +19516,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12949,24 +19549,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12975,23 +19583,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -12999,26 +19617,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -13027,21 +19650,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -13050,25 +19682,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -13076,22 +19714,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -13100,20 +19748,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "visibility", - "operation_type", - "repo", + "@timestamp", "_document_id", - "user", - "user_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "@timestamp", - "request_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -13121,19 +19780,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -13141,17 +19811,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -13160,17 +19845,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -13179,7 +19879,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -13194,22 +19915,30 @@ "description": "The cache retention policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -13221,22 +19950,30 @@ "description": "The cache storage policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -13248,23 +19985,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -13274,20 +20020,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -13298,21 +20055,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -13321,22 +20089,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -13345,21 +20123,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -13368,22 +20157,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -13394,16 +20193,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -13412,22 +20222,31 @@ "description": "Temporary access was enabled for a repository.", "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing user-owned repositories in your enterprise" }, @@ -13437,22 +20256,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", - "user", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -13461,23 +20291,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -13487,19 +20327,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -13507,21 +20357,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -13530,24 +20390,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -13555,25 +20424,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -13582,24 +20458,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13608,25 +20494,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -13635,22 +20529,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13659,26 +20562,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "visibility", - "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "visibility", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -13686,31 +20597,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13719,24 +20637,30 @@ "description": "Branch protections were disabled for the repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -13745,24 +20669,30 @@ "description": "Branch protections were enabled for this repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -13771,25 +20701,31 @@ "description": "Code security was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -13798,25 +20734,31 @@ "description": "Code security was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -13825,21 +20767,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -13847,21 +20799,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -13869,42 +20831,65 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" - ] - }, - { - "action": "repository_invitation.cancel", + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" + ] + }, + { + "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -13912,21 +20897,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -13934,19 +20930,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -13954,31 +20963,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -13987,19 +21004,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -14007,8 +21035,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -14017,23 +21044,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -14058,26 +21094,32 @@ "description": "Automatic partner validation checks have been disabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -14086,26 +21128,32 @@ "description": "Automatic partner validation checks have been enabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -14114,24 +21162,31 @@ "description": "A custom pattern was created for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", "business", "business_id", - "public_repo" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -14140,23 +21195,30 @@ "description": "A custom pattern was removed from secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14166,24 +21228,31 @@ "description": "A custom pattern was published for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14193,24 +21262,31 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -14219,24 +21295,31 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14246,23 +21329,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14272,23 +21362,31 @@ "description": "Secret scanning was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "public_repo", - "programmatic_access_type" + "public_repo" ], "docs_reference_titles": "About secret scanning" }, @@ -14297,22 +21395,30 @@ "description": "Secret scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14320,24 +21426,32 @@ "description": "Secret scanning for non-provider patterns was disabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -14346,24 +21460,32 @@ "description": "Secret scanning for non-provider patterns was enabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "public_repo", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -14372,19 +21494,31 @@ "description": "A role or team was added to the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -14393,24 +21527,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -14419,24 +21561,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -14445,19 +21595,31 @@ "description": "A role or team was removed from the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -14466,26 +21628,31 @@ "description": "Secret scanning push protection was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -14494,26 +21661,31 @@ "description": "Secret scanning push protection was enabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -14522,28 +21694,36 @@ "description": "A code security configuration was applied to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14551,27 +21731,35 @@ "description": "A code security configuration failed to attach to the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14579,28 +21767,36 @@ "description": "A code security configuration was removed from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14608,28 +21804,36 @@ "description": "A code security configuration was removed due to a change in repository or enterprise settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14637,29 +21841,37 @@ "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -14668,29 +21880,37 @@ "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -14699,19 +21919,32 @@ "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ - "operation_type", - "request_id", - "repo_id", "@timestamp", - "user_agent", - "alert_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "alert_id", + "created_at", + "alert_number" ], "docs_reference_titles": "About Dependabot alerts" }, @@ -14720,23 +21953,32 @@ "description": "A Dependabot alert was manually dismissed.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "operation_type", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "alert_id", - "actor", - "repo", "created_at", - "org", - "_document_id", - "action", - "actor_id", "dismiss_reason", - "user", "dismiss_comment", "alert_number", "actor_is_bot" @@ -14747,21 +21989,33 @@ "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "public_repo", "owner", - "_document_id", - "@timestamp", "operation_type", - "token_scopes", "alert_number" ] }, @@ -14770,26 +22024,34 @@ "description": "A Dependabot alert was manually reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type", - "business", - "business_id", "public_repo", - "alert_number", - "request_access_security_header" + "alert_number" ] }, { @@ -14797,21 +22059,32 @@ "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", "docs_reference_links": "N/A", "fields": [ - "alert_id", - "repo", - "operation_type", - "action", - "repo_id", - "_document_id", - "user_agent", - "request_id", "@timestamp", - "created_at", - "actor", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "alert_id", + "operation_type", + "created_at", + "alert_number" ] }, { @@ -14819,21 +22092,35 @@ "description": "A Dependabot alert was withdrawn.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", "created_at", "active", - "action", - "repository_id", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type" ] }, @@ -14842,20 +22129,30 @@ "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", "fields": [ - "org", + "@timestamp", "_document_id", - "repo", - "org_id", - "operation_type", - "created_at", - "actor", "action", - "@timestamp", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" }, @@ -14864,24 +22161,31 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -14889,26 +22193,32 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14916,23 +22226,30 @@ "description": "Dependabot alerts was disabled.", "docs_reference_links": "N/A", "fields": [ - "repo", - "request_id", - "repo_id", - "action", - "actor_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "_document_id", "user_id", - "operation_type", - "token_scopes", - "programmatic_access_type" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14940,23 +22257,30 @@ "description": "Dependabot alerts was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_agent", - "created_at", "@timestamp", - "repo_id", + "_document_id", "action", - "user", - "repo", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor_id", - "_document_id", - "user_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot" ] }, @@ -14965,18 +22289,31 @@ "description": "Email notification restrictions for an organization or enterprise were disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -14985,19 +22322,31 @@ "description": "Email notification restrictions for an organization or enterprise were enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -15006,14 +22355,28 @@ "description": "A user was assigned to a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15028,14 +22391,28 @@ "description": "GitHub detected a secret and created a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15049,22 +22426,32 @@ "description": "A secret scanning alert was reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type_display_name" ] }, @@ -15073,28 +22460,37 @@ "description": "A secret scanning alert was resolved.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "resolution", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", + "resolution", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type", "secret_type_display_name", "publicly_leaked", - "multi_repo", - "request_access_security_header" + "multi_repo" ] }, { @@ -15102,25 +22498,32 @@ "description": "A secret scanning alert was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -15128,14 +22531,28 @@ "description": "A user was unassigned from a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15150,14 +22567,28 @@ "description": "A secret scanning alert was validated.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "previous_validity", @@ -15174,19 +22605,30 @@ "description": "Secret scanning was disabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -15195,62 +22637,94 @@ "description": "Secret scanning was enabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" - ], - "docs_reference_titles": "About secret scanning" - }, - { - "action": "secret_scanning_new_repos.disable", - "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", - "fields": [ - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", + "user_agent", "created_at", - "_document_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About secret scanning" }, { - "action": "secret_scanning_new_repos.enable", - "description": "Secret scanning was enabled for all new repositories.", + "action": "secret_scanning_new_repos.disable", + "description": "Secret scanning was disabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", + "created_at" + ], + "docs_reference_titles": "About secret scanning" + }, + { + "action": "secret_scanning_new_repos.enable", + "description": "Secret scanning was enabled for all new repositories.", + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ "@timestamp", - "_document_id" + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -15259,14 +22733,28 @@ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "push_protection_bypass_reason", @@ -15284,25 +22772,33 @@ "description": "A request to bypass secret scanning push protection was approved by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -15311,25 +22807,33 @@ "description": "A request to bypass secret scanning push protection was denied by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", - "request_access_security_header", "request_reviewer_comment" ], "docs_reference_titles": "About push protection" @@ -15339,25 +22843,33 @@ "description": "A user requested to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" }, @@ -15366,22 +22878,35 @@ "description": "A secret scanning scan has completed on this repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "repo_id", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "source", "type", "source_slug", "type_slug", "started_at", "completed_at", - "repo", "public_repo", - "org", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "secret_types", @@ -15395,10 +22920,28 @@ "description": "A security configuration was created", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15413,15 +22956,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -15439,22 +22975,33 @@ "description": "A default security configuration setting for new repositories was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15463,22 +23010,33 @@ "description": "A default security configuration setting for new repositories was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "default_for_new_private_repos", - "default_for_new_public_repos", - "security_configuration_name", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "default_for_new_private_repos", + "default_for_new_public_repos", + "security_configuration_name", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15487,10 +23045,28 @@ "description": "A security configuration was deleted", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15505,15 +23081,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -15530,15 +23099,30 @@ "description": "A security configuration policy was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enforcement", "security_configuration_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15548,10 +23132,28 @@ "description": "A security configuration was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15566,15 +23168,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -15592,18 +23187,30 @@ "description": "A security key was registered for an account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "created_at", - "user_id", - "action", - "operation_type", - "request_id", "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -15611,18 +23218,30 @@ "description": "A security key was removed from an account.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "operation_type", - "_document_id", - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -15630,14 +23249,28 @@ "description": "A user linked a social identity to their account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -15647,14 +23280,28 @@ "description": "A user unlinked a social identity from their account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "action", - "_document_id", - "@timestamp", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -15664,15 +23311,28 @@ "description": "A user unlinked all social identities from their account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -15682,16 +23342,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15701,18 +23374,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -15721,16 +23407,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15741,15 +23440,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -15759,15 +23471,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -15776,17 +23503,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -15795,17 +23535,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -15814,16 +23568,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -15833,14 +23600,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -15850,17 +23632,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -15869,17 +23664,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -15888,18 +23696,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "sponsors_listing_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sponsors_listing_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -15908,15 +23729,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -15926,16 +23761,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -15943,15 +23791,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -15962,16 +23823,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -15981,17 +23855,30 @@ "description": "Triggered when you send an email update to your sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", "fields": [ - "request_id", - "actor", - "action", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" }, @@ -16000,17 +23887,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -16021,17 +23921,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -16042,18 +23955,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16063,16 +23987,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16082,17 +24019,30 @@ "description": "You join the waitlist to join GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_id", - "user_agent", "actor_id", - "action", - "operation_type", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "_document_id" + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -16101,16 +24051,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16122,17 +24085,30 @@ "fields": [ "@timestamp", "_document_id", - "fingerprint", - "operation_type", - "openssh_public_key", - "org_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "request_id" + "fingerprint", + "operation_type", + "openssh_public_key", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16141,19 +24117,32 @@ "description": "An SSH certificate authority for an organization or enterprise was deleted.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "created_at", + "@timestamp", "_document_id", - "fingerprint", - "operation_type", + "action", "actor", - "org_id", - "openssh_public_key", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", - "request_id" + "created_at", + "fingerprint", + "operation_type", + "openssh_public_key" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16162,21 +24151,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "user", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "request_id", - "org", - "org_id", - "created_at", - "actor", "action", - "user_id", + "actor", + "actor_id", "business", "business_id", - "@timestamp", - "actor_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16185,19 +24183,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "actor_id", - "user_id", - "org", - "operation_type", - "request_id", "@timestamp", "_document_id", - "actor", - "user", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16206,20 +24215,34 @@ "description": "The verification code expiry time for an organization or enterprise domain was set.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "token_expires_at", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16227,18 +24250,33 @@ "description": "An organization or enterprise domain was unverified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ] }, { @@ -16246,16 +24284,31 @@ "description": "An organization or enterprise domain was verified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "domain_name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16263,47 +24316,67 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "actor_is_bot", - "request_access_security_header" - ] + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", + "public_repo", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "sub_issues.parent_issue_remove", "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16311,23 +24384,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16335,23 +24418,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16359,15 +24452,30 @@ "description": "Triggered when you accept a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -16376,15 +24484,30 @@ "description": "Triggered when you cancel a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -16393,15 +24516,30 @@ "description": "Triggered when you create a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -16410,15 +24548,30 @@ "description": "Triggered when you decline a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -16427,15 +24580,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16443,38 +24611,63 @@ "description": "Triggered when you revoke a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id" - ], - "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" - }, - { - "action": "team.add_member", - "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", - "fields": [ - "user_agent", - "request_id", - "org_id", - "user_id", - "team", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "actor_id", - "created_at", + "user_id", + "user_agent", "operation_type", + "created_at" + ], + "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" + }, + { + "action": "team.add_member", + "description": "A member of an organization was added to a team.", + "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", + "fields": [ + "@timestamp", "_document_id", - "org", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" @@ -16484,22 +24677,31 @@ "description": "A team was given access and permissions to a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "team", - "action", - "operation_type", - "request_id", - "created_at", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "actor_id", - "_document_id", "repo_id", - "user_agent", - "org_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -16508,20 +24710,30 @@ "description": "A team was added to an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team_type", "team", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -16532,20 +24744,31 @@ "description": "A child team was created or a child team's parent was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", "fields": [ - "org", "@timestamp", - "created_at", "_document_id", - "team", "action", - "operation_type", "actor", - "request_id", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", + "operation_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" }, @@ -16554,18 +24777,31 @@ "description": "A team's privacy level was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", "fields": [ - "user_agent", - "request_id", - "org", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", "created_at", "operation_type", - "actor_id", - "org_id", - "@timestamp", - "actor", - "_document_id", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" @@ -16575,21 +24811,32 @@ "description": "A new team is created.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "oauth_application_id", + "operation_type", "team", - "org", - "actor", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "team_type" ] }, @@ -16598,21 +24845,31 @@ "description": "A user was demoted from a team maintainer to a team member.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" }, @@ -16621,19 +24878,31 @@ "description": "A team was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "team", "org_id", - "actor_id", - "actor", - "action", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", "operation_type", - "_document_id", - "programmatic_access_type", "team_type" ] }, @@ -16642,19 +24911,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "business_id", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", "actor_id", - "user", "business", - "action", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16662,19 +24942,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "operation_type", - "request_id", "actor", - "org", - "created_at", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", - "_document_id" + "operation_type", + "created_at" ] }, { @@ -16682,18 +24973,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", "@timestamp", - "action", "_document_id", - "user_agent", - "user_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business", + "user_id", + "user_agent", "operation_type", - "actor", "created_at" ] }, @@ -16702,22 +25004,31 @@ "description": "A user was promoted from a team member to a team maintainer.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" }, @@ -16726,20 +25037,30 @@ "description": "A team was removed from an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team_type", "team", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -16750,22 +25071,31 @@ "description": "An organization member was removed from a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", "fields": [ - "request_id", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "team", - "user_id", - "actor", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", + "user_id", "user_agent", - "_document_id", - "token_scopes", - "programmatic_access_type", + "operation_type", + "created_at", + "team", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" @@ -16775,21 +25105,31 @@ "description": "A repository was removed from a team's control.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "org_id", - "repo", - "repo_id", - "action", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "created_at", "team", - "org", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -16797,21 +25137,32 @@ "description": "A team's name was changed.", "docs_reference_links": "N/A", "fields": [ - "name", - "user_agent", - "created_at", - "team", - "operation_type", - "actor_id", - "org", + "@timestamp", + "_document_id", "action", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "_document_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "team", + "operation_type", "team_type" ] }, @@ -16820,17 +25171,30 @@ "description": "Team synchronization with a tenant was disabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "request_id", - "org_id", "actor_id", - "operation_type", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -16839,49 +25203,69 @@ "description": "Team synchronization with a tenant was enabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ - "org_id", - "business_id", - "actor", - "created_at", - "user_agent", "@timestamp", - "operation_type", - "business", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id" - ], - "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, { "action": "team.update_repository_permission", "description": "A team's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "team", - "org_id", "@timestamp", - "org", "_document_id", - "old_permission", - "request_id", - "repo", "action", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "old_permission", "operation_type", "created_at", - "user_agent", "permission", "new_repo_permission", "new_repo_base_role", "old_repo_permission", - "old_repo_base_role", - "token_scopes", - "programmatic_access_type" + "old_repo_base_role" ] }, { @@ -16889,17 +25273,30 @@ "description": "A new trusted device was added.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16907,17 +25304,30 @@ "description": "A trusted device was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16925,14 +25335,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "action", - "request_id", - "user_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -16941,15 +25366,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "created_at", - "user_id", - "operation_type", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action" + "created_at", + "operation_type" ] }, { @@ -16957,13 +25397,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "created_at", - "user_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -16971,17 +25428,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "operation_type", - "action", - "_document_id" + "created_at", + "operation_type" ] }, { @@ -16989,17 +25459,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user", - "created_at", - "request_id", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -17007,16 +25490,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17024,34 +25521,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_id", - "action", "@timestamp", - "created_at", - "user_agent", - "user", "_document_id", - "request_id" - ] - }, - { - "action": "two_factor_authentication.add_factor", - "description": "A secondary authentication factor was added to a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", - "fields": [ + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "two_factor_authentication.add_factor", + "description": "A secondary authentication factor was added to a user account.", + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -17060,18 +25584,30 @@ "description": "Two-factor authentication was disabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", "fields": [ - "actor", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor_id", + "user_agent", "created_at", - "operation_type", - "request_id", - "@timestamp", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Disabling two-factor authentication for your personal account" }, @@ -17080,18 +25616,30 @@ "description": "Two-factor authentication was enabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ - "actor", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Configuring two-factor authentication" }, @@ -17100,15 +25648,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user", - "user_id", - "action", "@timestamp", - "request_id", "_document_id", - "user_agent" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17116,16 +25679,29 @@ "description": "Two factor recovery codes were regenerated for a user account.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", + "operation_type", "created_at" ] }, @@ -17134,18 +25710,30 @@ "description": "A secondary authentication factor was removed from a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -17154,15 +25742,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "created_at", - "_document_id", - "action", - "@timestamp" + "operation_type", + "created_at" ] }, { @@ -17171,16 +25774,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "operation_type", "user_agent", - "action", - "request_id", - "actor", - "actor_id" + "created_at", + "operation_type" ] }, { @@ -17188,19 +25804,31 @@ "description": "An email address was added to a user account.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", "operation_type", - "_document_id", - "actor_id", - "actor", "email", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding an email address to your GitHub account" }, @@ -17209,18 +25837,30 @@ "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "created_at", - "user", "@timestamp", "_document_id", - "request_id", - "actor_id", - "operation_type", - "user_agent", "action", - "request_access_security_header" + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17228,15 +25868,28 @@ "description": "Audit log entries were exported.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "action", - "request_id", - "actor", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", "created_at" ] @@ -17246,20 +25899,31 @@ "description": "A user was blocked by another user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_id", - "_document_id", "actor_id", - "@timestamp", - "user_agent", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -17267,18 +25931,30 @@ "description": "A user changed their password.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "actor_id", - "operation_type", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "created_at", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17286,18 +25962,30 @@ "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -17306,17 +25994,30 @@ "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -17325,23 +26026,38 @@ "description": "Triggered when a user content edit is deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_content_id", "user_content_type", "created_at", - "user_agent", "deleted_by", "editor_id", - "_document_id", "deleted_at", - "action", - "actor_id", "editor", "deleted_by_id", "deleted_content", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -17349,16 +26065,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "user_agent", - "created_at", - "user", "action", - "operation_type", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17366,16 +26096,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "_document_id", "@timestamp", - "created_at", - "user_agent", - "operation_type", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17383,58 +26127,96 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "created_at", - "_document_id", - "user_agent", - "user_id", - "@timestamp", - "user", - "action", - "request_access_security_header" - ] - }, - { - "action": "user.create", - "description": "A new user account was created.", - "docs_reference_links": "N/A", - "fields": [ - "email", - "user_id", - "operation_type", "@timestamp", - "request_id", - "user", - "created_at", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "action", - "programmatic_access_type" - ] + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "user.create", + "description": "A new user account was created.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "email", + "operation_type", + "created_at" + ] }, { "action": "user.create_integration_secret", "description": "A user secret for Codespaces was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17442,20 +26224,31 @@ "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "user_agent", + "@timestamp", "_document_id", - "operation_type", - "oauth_application_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "@timestamp", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -17463,18 +26256,30 @@ "description": "A user account was destroyed by an asynchronous job.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "request_id", - "user_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17483,19 +26288,30 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "oauth_application_id", + "_document_id", "action", - "user", - "created_at", - "user_agent", - "request_id", "actor", "actor_id", - "operation_type", - "_document_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", + "operation_type" ] }, { @@ -17503,18 +26319,30 @@ "description": "A user deleted his or her account, triggering user.async_delete.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", - "created_at", - "user_agent", "user_id", - "operation_type", - "actor_id", - "action", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17522,18 +26350,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "user_agent", "user_id", - "actor_id", - "action", - "operation_type", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17541,18 +26381,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "operation_type", - "created_at", - "_document_id", - "@timestamp", - "user", - "actor_id", - "action", - "request_access_security_header" + "created_at" ] }, { @@ -17561,35 +26413,60 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user", "_document_id", "action", - "operation_type", - "user_agent", - "created_at", - "request_id", "actor", "actor_id", - "user_id", - "request_access_security_header" - ] - }, - { - "action": "user.disable_collaborators_only", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "user.disable_collaborators_only", "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -17597,17 +26474,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -17615,17 +26505,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -17633,21 +26536,31 @@ "description": "An enterprise managed user claimed an email address.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -17655,21 +26568,31 @@ "description": "N/A", "docs_reference_links": "An enterprise managed user unclaimed an email address.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." }, @@ -17678,17 +26601,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -17696,17 +26632,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -17714,17 +26663,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -17732,18 +26694,30 @@ "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "action", - "operation_type", - "request_id", - "created_at", - "_document_id", "@timestamp", - "user", - "org_id", + "_document_id", + "action", "actor", "actor_id", - "user_agent" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17751,35 +26725,62 @@ "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.", "docs_reference_links": "N/A", "fields": [ - "actor", - "actor_id", - "operation_type", "@timestamp", - "request_id", - "user", - "user_id", - "action", "_document_id", - "user_agent", - "created_at" - ] + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] }, { "action": "user.forgot_password", "description": "A user requested a password reset.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", "fields": [ - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "email", - "created_at", - "user_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" }, @@ -17788,17 +26789,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "created_at", - "user_agent", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor", - "operation_type", - "request_id" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17806,18 +26820,30 @@ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -17826,19 +26852,31 @@ "description": "A user signed in.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "actor_id", "@timestamp", - "user", - "action", - "operation_type", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "actor", - "passkey_nickname", - "request_access_security_header" + "passkey_nickname" ] }, { @@ -17846,18 +26884,30 @@ "description": "A user signed out.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17865,19 +26915,30 @@ "description": "A comment made by a user was minimized.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", - "actor_id", "@timestamp", - "created_at", - "operation_type", "_document_id", - "user", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -17885,18 +26946,30 @@ "description": "A user signed in from a new device.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17904,14 +26977,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", "_document_id", "action", - "@timestamp", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -17919,21 +27008,31 @@ "description": "An ordinary user account was promoted to a site administrator.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", + "user_id", "user_agent", + "created_at", "oauth_application_id", - "request_id", - "operation_type", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17941,16 +27040,29 @@ "description": "A user's account was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user", - "action", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "actor", "operation_type" ] }, @@ -17959,20 +27071,31 @@ "description": "An email address was removed from a user account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "actor", - "actor_id", "created_at", - "email", - "token_scopes", - "programmatic_access_type" + "email" ] }, { @@ -17980,20 +27103,32 @@ "description": "A user secret for Codespaces was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "key", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "key", + "integration", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -18001,17 +27136,30 @@ "description": "A user account was no longer flagged as a large scale contributor.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -18019,20 +27167,31 @@ "description": "A username was changed.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "request_id", - "actor_id", - "old_login", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "operation_type", "user_agent", - "token_scopes", - "programmatic_access_type" + "old_login", + "created_at", + "operation_type" ] }, { @@ -18040,17 +27199,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "user_agent", - "request_id", - "action", "@timestamp", - "created_at", - "org_id", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -18059,18 +27230,30 @@ "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "action", "created_at", - "actor", - "operation_type", - "actor_id", - "user_id", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam" }, @@ -18079,18 +27262,30 @@ "description": "A user reset their account password.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "@timestamp", - "_document_id", - "actor", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -18098,16 +27293,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_id", - "action", "@timestamp", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -18118,16 +27326,28 @@ "fields": [ "@timestamp", "_document_id", - "request_id", - "user_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor_id", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -18136,18 +27356,30 @@ "description": "A user signed in from an unrecognized device.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "action", + "@timestamp", "_document_id", - "user_agent", - "user", - "user_id", - "operation_type", - "created_at", + "action", "actor", "actor_id", - "@timestamp", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -18155,18 +27387,30 @@ "description": "A user signed in from an unrecognized device and location.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "created_at", - "_document_id", - "request_id", - "action", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -18174,18 +27418,30 @@ "description": "A user signed in from an unrecognized location.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "action", - "operation_type", - "user_agent", - "user", + "@timestamp", "_document_id", + "action", "actor", - "created_at", "actor_id", - "@timestamp", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -18193,22 +27449,33 @@ "description": "Triggered when you clear the status on your profile.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "message", - "user", - "actor_id", "created_at", - "request_id", "limited_availability", - "action", "emoji", - "operation_type", - "user_agent", - "@timestamp", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -18216,23 +27483,33 @@ "description": "Triggered when you set or change the status on your profile.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", "fields": [ - "limited_availability", - "user", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "message", - "user_id", - "created_at", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "limited_availability", + "message", + "created_at", "emoji", - "org", - "actor", - "operation_type", - "token_scopes", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Personalize your profile" }, @@ -18241,21 +27518,31 @@ "description": "A user account was suspended.", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", - "operation_type", - "actor_id", - "user", - "user_agent", - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", - "user_id", + "_document_id", "action", - "token_scopes", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -18263,18 +27550,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", - "actor_id", "@timestamp", - "operation_type", "_document_id", - "user_agent", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -18282,18 +27581,30 @@ "description": "A 2FA challenge issued for a user account failed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "_document_id", - "user_agent", - "user", - "actor_id", - "actor", - "user_id", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -18303,16 +27614,28 @@ "fields": [ "@timestamp", "_document_id", - "user_id", - "operation_type", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "actor", + "user_id", "user_agent", - "request_id", - "action", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -18320,18 +27643,30 @@ "description": "A user used their 2FA recovery codes.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "user_agent", - "request_id", - "user", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "created_at", - "@timestamp", - "_document_id", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -18339,18 +27674,30 @@ "description": "A user downloaded 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -18358,17 +27705,30 @@ "description": "A user printed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", - "user_agent", - "request_id", - "user_id", - "created_at", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -18376,18 +27736,30 @@ "description": "A user viewed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_agent", - "actor", - "user_id", - "action", - "created_at", - "user", - "operation_type", "@timestamp", - "request_id", "_document_id", - "request_access_security_header" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -18395,17 +27767,30 @@ "description": "A user was prompted for a two-factor authentication code.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", "fields": [ - "user", - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "actor" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" }, @@ -18414,19 +27799,31 @@ "description": "A user was unblocked by another user.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "actor", - "@timestamp", - "user_agent", - "user_id", - "user", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -18435,15 +27832,28 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user_agent", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "request_id", - "actor", - "action", "created_at" ] }, @@ -18452,21 +27862,31 @@ "description": "A user account was unsuspended.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", - "user", "action", - "user_agent", "actor", - "oauth_application_id", - "operation_type", "actor_id", - "created_at", - "@timestamp", - "user_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -18474,21 +27894,33 @@ "description": "A user secret for Codespaces was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -18496,18 +27928,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -18515,16 +27959,30 @@ "description": "A Dependabot rule was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -18534,16 +27992,30 @@ "description": "A Dependabot rule was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -18553,18 +28025,31 @@ "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -18574,21 +28059,33 @@ "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -18596,21 +28093,32 @@ "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -18618,21 +28126,32 @@ "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -18640,16 +28159,30 @@ "description": "A Dependabot rule's conditions, actions, or metadata changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -18659,27 +28192,33 @@ "description": "A workflow job was approved.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", - "repo", - "repo_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -18688,23 +28227,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -18712,10 +28261,28 @@ "description": "A workflow run was cancelled.", "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -18726,20 +28293,9 @@ "run_number", "cancelled_at", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Canceling a workflow run" }, @@ -18748,23 +28304,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -18774,10 +28338,28 @@ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -18789,19 +28371,9 @@ "conclusion", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -18812,10 +28384,28 @@ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -18824,21 +28414,10 @@ "head_branch", "head_sha", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "public_repo", - "programmatic_access_type", "actor_is_bot", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "Understanding GitHub Actions" @@ -18848,23 +28427,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -18873,22 +28464,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -18896,21 +28498,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -18918,25 +28531,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -18944,23 +28565,36 @@ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", "fields": [ - "repo_id", - "repo", - "org_id", - "org", - "business_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "job_name", "runner_labels", "is_hosted_runner", "environment_name", "secrets_passed", - "action", - "_document_id", "operation_type", "created_at", - "@timestamp", "runner_owner_type", "job_workflow_ref", "calling_workflow_refs", @@ -18974,24 +28608,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -19000,10 +28643,28 @@ "description": "A workflow run was re-run.", "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -19013,21 +28674,11 @@ "head_sha", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", "rerun_type", "check_run_id", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "Re-running workflows and jobs" @@ -19037,25 +28688,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.20/organization.json b/src/audit-logs/data/ghes-3.20/organization.json index 4131528a7e6e..4c7245c78379 100644 --- a/src/audit-logs/data/ghes-3.20/organization.json +++ b/src/audit-logs/data/ghes-3.20/organization.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,29 +67,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -72,21 +103,32 @@ "description": "Credit was accepted for a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Editing a repository security advisory" }, @@ -95,21 +137,32 @@ "description": "Someone was added to the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -117,21 +170,32 @@ "description": "Credit was declined for a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -140,21 +204,32 @@ "description": "Someone was removed from the credit section of a security advisory.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "ghsa_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ghsa_id", "recipient", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -163,18 +238,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -182,17 +269,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -203,43 +301,66 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" - }, + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + }, { "action": "billing.budget_create", "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -255,22 +376,34 @@ "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "uuid", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -278,25 +411,37 @@ "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", - "request_access_security_header", "old_target_amount", "old_budget_limit_type", "old_alert_enabled", @@ -310,17 +455,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -329,19 +487,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -350,15 +520,28 @@ "description": "Azure subscription has been linked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -368,15 +551,28 @@ "description": "Azure subscription has been unlinked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -386,18 +582,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -405,16 +614,28 @@ "description": "The premium request paid usage policy for your GitHub account was changed.", "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -426,39 +647,62 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "operation_type", - "user_agent", - "created_at", - "user_id", - "request_id", - "actor", - "action", "@timestamp", "_document_id", - "programmatic_access_type" - ] - }, - { - "action": "checks.auto_trigger_disabled", - "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", - "fields": [ - "visibility", - "user_agent", - "user", - "@timestamp", - "repo", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "checks.auto_trigger_disabled", + "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -467,20 +711,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -491,17 +746,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -509,15 +776,31 @@ "description": "Existing code scanning alerts appeared in a branch.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -527,15 +810,31 @@ "description": "Code scanning alerts were fixed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -545,15 +844,31 @@ "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_numbers", "commit_oid", - "ref", - "request_id", - "org_id", - "org", - "business_id", - "business" + "ref" ], "docs_reference_titles": "About code scanning" }, @@ -562,15 +877,29 @@ "description": "Code scanning alerts were manually dismissed.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers", "dismissal_approver_id" ], @@ -581,19 +910,31 @@ "description": "Dismissal of code scanning alerts was approved.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -604,19 +945,31 @@ "description": "Dismissal of code scanning alerts was denied.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "dismissal_request_id", - "alert_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", - "action", - "_document_id", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismissal_request_id", + "alert_number", + "public_repo", "created_at", "operation_type" ], @@ -627,19 +980,31 @@ "description": "Dismissal of code scanning alerts was requested.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "dismissal_request_id", "alert_number", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -650,13 +1015,31 @@ "description": "Code scanning alerts were seen for the first time.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -666,15 +1049,31 @@ "description": "Code scanning alerts that were previously fixed reappeared.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_number", "commit_oid", "ref", - "request_id", - "org_id", - "org", - "business_id", - "business", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -684,15 +1083,29 @@ "description": "Code scanning alerts that were previously dismissed were reopened.", "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning", "fields": [ - "repo_id", - "alert_number", - "actor_id", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", - "business_id", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_number", "alert_numbers" ], "docs_reference_titles": "About code scanning" @@ -702,14 +1115,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -719,28 +1147,34 @@ "description": "An attempt to create a codespace from a prebuild was made.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "owner", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "user_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_id", + "user_agent", + "name", + "owner", + "pull_request_id", "created_at", "operation_type", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -748,17 +1182,30 @@ "description": "Enterprise setting for Codespaces ownership was updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enablement", "organization_names", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -769,25 +1216,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -798,22 +1254,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -825,22 +1292,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -849,15 +1327,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -868,15 +1361,28 @@ "description": "Policies were applied to codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -886,20 +1392,30 @@ "description": "Policies were removed from codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -907,19 +1423,30 @@ "description": "Policies were updated for codespaces in an organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -927,17 +1454,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -947,27 +1487,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", - "org", "owner", "pull_request_id", "machine_type", - "user_id", - "user", "devcontainer_path", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -975,19 +1524,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -995,18 +1557,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -1015,20 +1589,30 @@ "description": "A commit comment was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "repo", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "created_at", - "@timestamp", - "operation_type", + "programmatic_access_type", + "repo", "repo_id", - "actor_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", - "user_agent", - "action", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1036,21 +1620,30 @@ "description": "A commit comment was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "repo_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_id", - "action", - "@timestamp", - "repo", "org_id", - "actor_id", - "created_at", - "user_agent", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1058,21 +1651,33 @@ "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "reason", "plan", - "org_id", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1080,13 +1685,28 @@ "description": "Copilot feature settings were changed at the organization level.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1096,23 +1716,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -1120,16 +1747,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -1138,24 +1779,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -1163,15 +1810,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1181,20 +1841,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -1202,19 +1872,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -1222,21 +1904,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "business", - "business_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1244,21 +1935,33 @@ "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_value", "new_value", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -1266,21 +1969,32 @@ "description": "The excluded paths for GitHub Copilot were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "excluded_paths", "owner_type", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1288,14 +2002,28 @@ "description": "Copilot custom instructions were created for the organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "action", - "_document_id", - "@timestamp", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "custom_instructions" @@ -1306,14 +2034,28 @@ "description": "Copilot custom instructions were updated for the organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "action", - "_document_id", - "@timestamp", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "custom_instructions" @@ -1324,17 +2066,30 @@ "description": "The plan for GitHub Copilot was updated.", "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_plan", "plan", - "business_id", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -1346,20 +2101,31 @@ "description": "The plan for GitHub Copilot was scheduled to be downgraded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "current_plan", "scheduled_plan" @@ -1370,18 +2136,30 @@ "description": "MCP Configuration for Copilot coding agent was updated for a specific repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "new_config", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "new_config", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1391,22 +2169,33 @@ "description": "Specific repositories were disabled from using Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "owner_type", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1414,21 +2203,31 @@ "description": "Specific repositories were enabled to use Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "owner_type", - "owner", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1438,20 +2237,32 @@ "description": "Copilot coding agent access was updated for the organization's or user's repositories.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_access", "old_access", - "org_id", "owner_type", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1461,21 +2272,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1485,19 +2305,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1507,21 +2336,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1531,18 +2369,31 @@ "description": "A new custom property definition was created.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -1555,18 +2406,31 @@ "description": "A custom property definition was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "value_type", "required", "default_value", @@ -1580,14 +2444,29 @@ "description": "A custom property definition was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "property_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "value_type", @@ -1600,8 +2479,7 @@ "old_default_value", "old_value_type", "old_values_editable_by", - "values_editable_by", - "request_access_security_header" + "values_editable_by" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1610,27 +2488,35 @@ "description": "A repository's custom property value was manually set for the first time.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1639,19 +2525,31 @@ "description": "A repository's custom property value was deleted.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" }, @@ -1660,16 +2558,29 @@ "description": "A repository's custom property value was updated.", "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repository", - "repository_id", - "public_repo", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "public_repo", "created_at", "operation_type", "definition_id" @@ -1681,19 +2592,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1702,19 +2624,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1723,19 +2656,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1744,19 +2688,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1765,21 +2720,31 @@ "description": "The default repository access for Dependabot was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "access_level", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -1788,17 +2753,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1806,19 +2784,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1827,19 +2816,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1847,40 +2847,62 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependabot_security_updates_new_repos.enable", - "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A", - "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + }, + { + "action": "dependabot_security_updates_new_repos.enable", + "description": "Dependabot security updates were enabled for all new repositories.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1888,19 +2910,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1909,19 +2942,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1929,19 +2973,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1950,20 +3005,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1971,21 +3036,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", - "repo_id", - "request_id", + "@timestamp", + "_document_id", "action", "actor", - "org_id", - "_document_id", "actor_id", - "operation_type", - "@timestamp", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -1993,20 +3067,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo_id", "@timestamp", - "actor", - "user_agent", - "request_id", - "org", "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "repo", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2014,22 +3098,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "user_agent", - "actor_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "title", - "_document_id", - "created_at", - "repo", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -2037,21 +3130,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "team", - "created_at", - "user_id", "@timestamp", - "number", - "org", - "title", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", "user_agent", - "operation_type", - "_document_id" + "team", + "created_at", + "number", + "title", + "operation_type" ] }, { @@ -2059,18 +3164,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user_id", - "actor", "number", - "user", - "created_at", - "request_id", - "_document_id" + "created_at" ] }, { @@ -2078,18 +3196,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "action", - "_document_id", - "request_id", - "org", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org_id", "user_agent", - "actor", + "operation_type", "number", "team", "created_at" @@ -2100,21 +3229,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "_document_id", - "title", - "user", - "user_agent", - "org", - "operation_type", - "actor_id", "@timestamp", - "actor", - "team", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", + "title", + "operation_type", + "team", "number" ] }, @@ -2123,17 +3263,31 @@ "description": "A global announcement banner was created for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2144,16 +3298,30 @@ "description": "A global announcement banner was removed from the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "owner", "owner_type", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2164,18 +3332,32 @@ "description": "A global announcement banner was updated for the enterprise.", "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", - "business_id", "message", "old_message", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -2186,17 +3368,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was created.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", - "operation_type", "@timestamp", "_document_id", - "org_id", "action", - "request_id", - "org", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -2205,17 +3400,30 @@ "description": "The GitHub App associated with a GitHub Connect connection was deleted.", "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", "fields": [ - "created_at", + "@timestamp", "_document_id", "action", - "@timestamp", - "actor_id", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" }, @@ -2224,22 +3432,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2248,22 +3465,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2271,28 +3498,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2301,27 +3534,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -2330,25 +3571,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2357,26 +3606,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2385,21 +3641,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -2408,22 +3676,32 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2432,25 +3710,34 @@ "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -2459,22 +3746,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -2483,21 +3782,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -2508,19 +3817,30 @@ "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2529,20 +3849,30 @@ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2551,19 +3881,30 @@ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ - "transport_protocol", - "request_id", - "repository", - "repository_id", - "repository_public", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "transport_protocol", + "repository_public", "transport_protocol_name" ] }, @@ -2572,23 +3913,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2596,18 +3946,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -2618,20 +3978,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -2641,25 +4011,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -2667,25 +4047,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -2693,26 +4082,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -2721,25 +4119,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -2747,26 +4154,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -2774,21 +4190,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -2797,19 +4224,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -2817,21 +4257,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -2840,19 +4291,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -2863,20 +4328,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2886,24 +4363,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2914,23 +4402,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2941,21 +4441,33 @@ "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", "operation_type", - "@timestamp", "integration", - "action", - "user_agent", "reason", - "_document_id", - "org", - "org_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -2966,20 +4478,32 @@ "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", "fields": [ "@timestamp", - "actor_id", - "org", "_document_id", - "requester", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "requester", "created_at", "url", - "org_id", - "request_id", "operation_type", - "actor", "integration", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" @@ -2989,20 +4513,33 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -3012,19 +4549,33 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "name", "repository_selection", - "actor_id", "integration", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -3033,20 +4584,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -3056,20 +4620,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -3078,20 +4655,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -3100,20 +4690,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -3121,19 +4723,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -3142,19 +4757,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -3163,17 +4791,30 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -3186,21 +4827,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -3214,17 +4868,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -3236,19 +4903,30 @@ "description": "An IP allow list was disabled.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "actor", - "request_id", - "org", - "user_agent", + "@timestamp", "_document_id", - "user_id", + "action", + "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "@timestamp", - "user" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3256,19 +4934,30 @@ "description": "An IP allow list was disabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3276,20 +4965,29 @@ "description": "An IP allow list was enabled.", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "user_id", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "business_id", - "_document_id", - "action", - "@timestamp", + "user_id", "user_agent", - "actor_id", "operation_type", - "org", "created_at" ] }, @@ -3298,19 +4996,30 @@ "description": "An IP allow list was enabled for installed GitHub Apps.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3318,24 +5027,32 @@ "description": "An IP address was added to an IP allow list.", "docs_reference_links": "N/A", "fields": [ - "active", - "org", - "ip_allow_list_entry", "@timestamp", "_document_id", - "operation_type", - "created_at", - "user_agent", "action", - "request_id", + "actor", "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "business", - "actor", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", + "ip_allow_list_entry", + "operation_type", + "created_at" ] }, { @@ -3343,24 +5060,32 @@ "description": "An IP address was deleted from an IP allow list.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "ip_allow_list_entry", - "org", - "operation_type", - "created_at", - "active", "action", - "@timestamp", + "actor", + "actor_id", "business", "business_id", - "user_agent", + "hashed_token", + "org", "org_id", - "actor", - "actor_id", - "token_scopes", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "ip_allow_list_entry", + "operation_type", + "created_at", + "active" ] }, { @@ -3368,19 +5093,32 @@ "description": "An IP address or its description was changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at", - "user_agent", - "actor_id", "ip_allow_list_entry", - "active", - "org_id", - "@timestamp" + "active" ] }, { @@ -3388,22 +5126,31 @@ "description": "A comment on an issue was deleted from the repository.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "org", - "repo", - "actor_id", "@timestamp", - "created_at", "_document_id", "action", - "operation_type", - "user_agent", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "oauth_application_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -3411,24 +5158,30 @@ "description": "A comment on an issue was pinned to a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "public_repo", "created_at", "operation_type", "actor_is_bot" @@ -3439,19 +5192,29 @@ "description": "A comment on an issue was unpinned from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3462,22 +5225,31 @@ "description": "A comment on an issue (other than the initial one) changed.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", - "action", - "repo_id", - "org_id", - "created_at", - "operation_type", "@timestamp", - "user_agent", - "request_id", "_document_id", - "actor_id", + "action", "actor", - "oauth_application_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -3485,20 +5257,30 @@ "description": "An issue was marked as blocked by another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3509,19 +5291,30 @@ "description": "The blocked by relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -3531,20 +5324,30 @@ "description": "An issue was marked as blocking another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3555,20 +5358,30 @@ "description": "The blocking relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3579,21 +5392,31 @@ "description": "An issue was deleted from the repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", "fields": [ - "user", - "actor_id", - "created_at", - "title", "@timestamp", "_document_id", - "request_id", - "actor", - "user_id", "action", - "operation_type", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "title", + "operation_type" ], "docs_reference_titles": "Deleting an issue" }, @@ -3602,23 +5425,33 @@ "description": "An issue was pinned to a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ + "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", "action", "actor", - "operation_type", - "owner_type", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "number", - "repo", - "event", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type", + "owner_type", + "number", + "event" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -3627,22 +5460,32 @@ "description": "An issue was transferred to another repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "owner_type", - "actor_id", "number", - "repo", "operation_type", - "_document_id", - "repo_id", - "action", - "request_id", - "created_at", - "actor", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Transferring an issue to another repository" }, @@ -3651,20 +5494,32 @@ "description": "An issue type was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issue_type_name", "description", "color", "enabled", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3675,20 +5530,32 @@ "description": "An issue type was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issue_type_name", "description", "color", "enabled", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3699,11 +5566,28 @@ "description": "An issue type was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issue_type_name", "description", "color", @@ -3712,11 +5596,6 @@ "old_description", "old_color", "old_enabled", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -3727,24 +5606,33 @@ "description": "An issue was unpinned from a repository.", "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", "fields": [ - "event", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", - "action", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "operation_type", - "_document_id", - "number", - "owner_type", - "@timestamp", + "token_id", + "token_scopes", "user", "user_id", - "token_scopes", - "request_access_security_header" + "user_agent", + "event", + "created_at", + "operation_type", + "number", + "owner_type" ], "docs_reference_titles": "Pinning an issue to your repository" }, @@ -3753,19 +5641,30 @@ "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user_agent", - "action", "@timestamp", - "operation_type", - "request_id", - "actor_id", - "user_id", - "created_at", "_document_id", + "action", "actor", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "org_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3774,18 +5673,29 @@ "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -3795,19 +5705,30 @@ "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", "fields": [ - "user", - "request_id", - "actor", - "business_id", - "action", - "operation_type", - "user_agent", - "created_at", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor_id" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -3816,18 +5737,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3835,21 +5768,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -3857,21 +5803,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", "marketplace_listing", - "@timestamp", "integration", - "org_id", - "action", - "org", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -3879,22 +5838,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", + "user_id", "user_agent", + "primary_category", + "created_at", "oauth_application", - "action", - "request_id", "marketplace_listing", - "user_id", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -3902,19 +5874,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -3924,22 +5909,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -3947,22 +5945,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -3970,20 +5981,30 @@ "description": "The ability for members to publish GitHub Pages sites was disabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -3992,20 +6013,30 @@ "description": "The ability for members to publish GitHub Pages sites was enabled.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4014,21 +6045,30 @@ "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4037,22 +6077,30 @@ "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4061,21 +6109,30 @@ "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "business", - "business_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4084,22 +6141,30 @@ "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" }, @@ -4108,19 +6173,30 @@ "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "operation_type", "user_agent", - "actor", - "actor_id", - "business_id", - "@timestamp", - "created_at", - "action" + "operation_type", + "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -4129,18 +6205,29 @@ "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "request_id", - "org", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "actor", "operation_type", - "org_id", - "action", - "@timestamp", "created_at" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" @@ -4150,21 +6237,30 @@ "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", "fields": [ - "action", - "org_id", - "user_id", - "business", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business_id", + "user_id", + "user_agent", "created_at", - "actor", - "org", - "operation_type", - "user_agent" + "operation_type" ], "docs_reference_titles": "Enforcing repository management policies in your enterprise" }, @@ -4175,16 +6271,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "created_at", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -4193,21 +6300,30 @@ "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", - "created_at", - "user_id", "business_id", - "user", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "org_id", - "@timestamp" + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -4216,19 +6332,30 @@ "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", "fields": [ - "request_id", - "created_at", - "_document_id", - "user_agent", - "user", - "user_id", - "business", - "business_id", - "operation_type", "@timestamp", + "_document_id", "action", "actor", - "actor_id" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -4237,19 +6364,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4257,21 +6396,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4281,16 +6429,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4300,18 +6461,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4321,14 +6495,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -4336,19 +6526,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -4356,18 +6557,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -4375,23 +6588,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -4399,16 +6620,30 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "org_id", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4416,24 +6651,32 @@ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", - "repo_id", "operation_type", - "@timestamp", - "user_agent", "created_at", - "org", - "action", - "_document_id", - "repo", - "actor", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -4441,15 +6684,28 @@ "description": "A network configuration for a hosted compute service was created.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -4467,15 +6723,28 @@ "description": "A network configuration for a hosted compute service was deleted.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -4488,15 +6757,28 @@ "description": "A network configuration for a hosted compute service was updated.", "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot", @@ -4513,20 +6795,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4535,20 +6829,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4557,20 +6863,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4579,20 +6897,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4601,19 +6931,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4622,20 +6965,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4644,20 +6999,32 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4666,19 +7033,32 @@ "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -4687,17 +7067,28 @@ "description": "An invitation sent to an organization to join an enterprise was accepted.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4708,20 +7099,30 @@ "description": "A billing manager was added to an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "org", - "user_id", "action", - "created_at", - "org_id", - "user", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" }, @@ -4730,19 +7131,29 @@ "description": "An organization prevented access to resources by users with the given two-factor method.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "two_factor_method", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "two_factor_method", "created_at", "operation_type", "actor_is_bot" @@ -4753,21 +7164,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -4776,24 +7197,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4801,21 +7232,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -4823,20 +7264,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -4844,22 +7295,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -4867,20 +7326,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -4888,22 +7357,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "business", - "business_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -4911,21 +7388,31 @@ "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "new_policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "new_policy", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -4935,19 +7422,30 @@ "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" }, @@ -4956,19 +7454,30 @@ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" @@ -4978,15 +7487,28 @@ "description": "Third-party application access for outside collaborators was disabled for the organization.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -4997,15 +7519,28 @@ "description": "Third-party application access for outside collaborators was enabled for the organization.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5016,15 +7551,28 @@ "description": "The organization was archived.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5034,17 +7582,30 @@ "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", "fields": [ - "org_id", - "operation_type", "@timestamp", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" }, @@ -5053,21 +7614,32 @@ "description": "An export of the organization's Git events was created.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "start", "end", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" }, @@ -5076,16 +7648,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_agent", - "action", "@timestamp", - "actor_id", - "org_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -5094,18 +7679,31 @@ "description": "An organization owner blocked a user from accessing the organization's repositories.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "blocked_user", - "action", - "operation_type", - "actor_id", - "org", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" }, @@ -5114,19 +7712,30 @@ "description": "An invitation for an organization to join an enterprise was revoked", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "initiated_from" ], "docs_reference_titles": "Adding organizations to your enterprise" @@ -5136,22 +7745,33 @@ "description": "An invitation sent to a user to join an organization was revoked.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "email", - "@timestamp", - "actor", - "action", "operation_type", - "user_agent", - "org", "invitation_id", - "_document_id", "created_at", - "invitee_email", - "token_scopes", - "programmatic_access_type" + "invitee_email" ] }, { @@ -5159,19 +7779,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -5179,16 +7810,28 @@ "description": "Cleared two-factor authentication restrictions for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -5199,23 +7842,31 @@ "description": "Autofix for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5223,21 +7874,31 @@ "description": "Autofix for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5245,23 +7906,31 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5269,23 +7938,31 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -5293,10 +7970,28 @@ "description": "Enablement for Code Security features on new repositories has been locked for this organization.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "action", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5305,11 +8000,29 @@ "action": "org.code_security_metered_usage_unlock", "description": "Enablement for Code Security features on new repositories has been unlocked for this organization.", "docs_reference_links": "N/A", - "fields": [ - "org_id", - "action", - "_document_id", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -5319,21 +8032,30 @@ "description": "Code scanning using the default setup was disabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -5342,21 +8064,30 @@ "description": "Code scanning using the default setup was enabled for an organization.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning at scale" }, @@ -5365,20 +8096,31 @@ "description": "Access to use Codespaces on internal and private repositories was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "enablement", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "enablement", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization" }, @@ -5387,21 +8129,31 @@ "description": "Ownership and payment for codespaces was updated for an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "owner_type", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" }, @@ -5410,16 +8162,29 @@ "description": "A team has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5429,16 +8194,29 @@ "description": "A team has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -5448,19 +8226,30 @@ "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -5469,17 +8258,30 @@ "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -5488,21 +8290,30 @@ "description": "A user has been allowed to use Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -5510,21 +8321,30 @@ "description": "A user has been prevented from using Codespaces for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -5532,16 +8352,29 @@ "description": "The interaction limit for collaborators only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "request_id", - "org", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" @@ -5551,17 +8384,30 @@ "description": "The interaction limit for prior contributors only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "operation_type", "@timestamp", - "created_at", - "user_agent", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", - "actor", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5570,17 +8416,30 @@ "description": "The interaction limit for existing users only for an organization was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", "_document_id", - "operation_type", - "actor_id", - "org_id", "action", - "created_at", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5590,16 +8449,29 @@ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ "@timestamp", - "created_at", "_document_id", - "actor_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "action", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5608,17 +8480,30 @@ "description": "The interaction limit for prior contributors only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "operation_type", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5627,17 +8512,30 @@ "description": "The interaction limit for existing users only for an organization was enabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", "fields": [ - "actor_id", - "request_id", + "@timestamp", + "_document_id", "action", - "created_at", - "user_agent", "actor", - "_document_id", - "org_id", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" }, @@ -5646,22 +8544,30 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" }, @@ -5670,17 +8576,28 @@ "description": "An invitation for an organization to join an enterprise was confirmed.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5691,15 +8608,28 @@ "description": "Server statistics were exported for the organization.", "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -5710,18 +8640,30 @@ "description": "An organization was created.", "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "org", - "actor_id", - "actor", - "action", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "org_id", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" }, @@ -5730,20 +8672,31 @@ "description": "A GitHub Actions secret was created for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5752,20 +8705,32 @@ "description": "A GitHub Actions variable was created for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5774,21 +8739,33 @@ "description": "A Codespaces or Dependabot secret was created for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -5796,21 +8773,30 @@ "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor_id", - "org_id", - "business", - "action", "@timestamp", - "org", "_document_id", - "business_id", + "action", "actor", - "token_scopes", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "actor_is_bot", "oauth_credential_type", "managed_oauth_access_id", @@ -5826,24 +8812,32 @@ "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", "fields": [ - "user_agent", - "actor", "@timestamp", - "created_at", - "org_id", - "business_id", - "operation_type", - "request_id", "_document_id", "action", + "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", - "token_scopes", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot", "oauth_credential_type", - "request_access_security_header", "managed_oauth_access_id", "managed_token_id", "managed_oauth_scopes", @@ -5857,21 +8851,32 @@ "description": "An owner revoked authorized credentials.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "oauth_application_id", - "org_id", "operation_type", - "action", - "business", - "request_id", "created_at", - "business_id", - "actor_id", - "_document_id", - "user_agent", "oauth_credential_type", "managed_oauth_access_id", "managed_token_id", @@ -5886,18 +8891,30 @@ "description": "An organization was deleted by a user or staff.", "docs_reference_links": "N/A", "fields": [ - "user_agent", "@timestamp", "_document_id", - "created_at", - "actor", - "org_id", - "org", "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -5905,20 +8922,30 @@ "description": "Team creation was limited to owners.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "actor", "@timestamp", "_document_id", - "user", - "user_id", "action", - "created_at", + "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -5927,16 +8954,29 @@ "description": "Third-party application access restrictions for an organization were disabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "org_id", - "action", - "_document_id", - "request_id", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" @@ -5946,19 +8986,30 @@ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -5967,14 +9018,31 @@ "description": "SAML single sign-on was disabled for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sso_url", "issuer", - "action", - "@timestamp", - "_document_id", "created_at", - "org", "operation_type" ] }, @@ -5983,21 +9051,30 @@ "description": "Display of IP addresses within audit log events for the organization was disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" }, @@ -6006,17 +9083,30 @@ "description": "A two-factor authentication requirement was disabled for the organization.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org", - "org_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "_document_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6024,19 +9114,30 @@ "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "user", - "action", - "operation_type", "@timestamp", "_document_id", - "created_at", - "user_agent", - "org", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "request_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6044,19 +9145,30 @@ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "user", - "action", - "actor_id", - "org_id" + "created_at" ] }, { @@ -6064,19 +9176,30 @@ "description": "Team creation by members was allowed.", "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", "fields": [ - "org_id", - "user", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" }, @@ -6085,17 +9208,30 @@ "description": "Third-party application access restrictions for an organization were enabled.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", "fields": [ - "actor_id", - "operation_type", - "org", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" }, @@ -6104,19 +9240,30 @@ "description": "An organization owner allowed users with read access to create discussions in an organization", "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" }, @@ -6125,19 +9272,32 @@ "description": "SAML single sign-on was enabled for the organization.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "actor", "sso_url", - "org", "created_at", - "@timestamp", - "issuer", - "org_id", - "_document_id", - "user_agent", - "request_id" + "issuer" ], "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" }, @@ -6146,21 +9306,30 @@ "description": "Display of IP addresses within audit log events for the organization was enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" }, @@ -6169,17 +9338,30 @@ "description": "Two-factor authentication is now required for the organization.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "actor_id", - "action", - "_document_id", - "org", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" }, @@ -6188,17 +9370,30 @@ "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "org_id", - "manager", "@timestamp", - "request_id", - "actor", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "manager", + "operation_type", "created_at" ] }, @@ -6207,18 +9402,31 @@ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", "docs_reference_links": "N/A", "fields": [ - "org_id", "@timestamp", - "org", - "user_agent", - "request_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "manager", "operation_type", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6226,23 +9434,32 @@ "description": "A new user was invited to join an organization.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", "fields": [ - "org", - "user_id", - "invitation_id", - "org_id", - "user", - "action", - "operation_type", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", - "created_at", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "invitee_email", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitation_id", + "operation_type", + "created_at", + "invitee_email" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" }, @@ -6251,17 +9468,28 @@ "description": "An organization was invited to join an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -6271,19 +9499,30 @@ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -6291,19 +9530,30 @@ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", "docs_reference_links": "N/A", "fields": [ - "org", - "org_id", - "user_agent", - "actor_id", - "user_id", - "operation_type", "@timestamp", - "created_at", - "request_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6311,19 +9561,31 @@ "description": "Access to an organization was granted for an OAuth App.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", "fields": [ - "url", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "request_id", "actor_id", - "operation_type", - "org_id", - "_document_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" @@ -6333,20 +9595,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -6355,18 +9628,31 @@ "description": "Access was disabled for an OAuth App that was previously approved.", "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", "fields": [ - "request_id", - "url", - "created_at", - "org_id", - "action", "@timestamp", "_document_id", - "user_agent", - "org", - "operation_type", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", + "created_at", + "operation_type", "oauth_application_name" ], "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" @@ -6376,19 +9662,31 @@ "description": "An organization member requested that an owner grant an OAuth App access to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", + "@timestamp", "_document_id", - "request_id", - "url", - "org_id", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "url", "oauth_application_name" ] }, @@ -6397,20 +9695,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "url", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "url", "created_at", "operation_type", - "business", - "business_id", "oauth_application_name" ] }, @@ -6420,16 +9729,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "org_id", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "operation_type", - "_document_id", - "org" + "created_at", + "operation_type" ] }, { @@ -6437,20 +9759,31 @@ "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "reason", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "reason", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -6459,20 +9792,30 @@ "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" }, @@ -6481,19 +9824,30 @@ "description": "An organization owner downloaded the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6502,19 +9856,30 @@ "description": "An organization owner generated the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6523,19 +9888,30 @@ "description": "An organization owner printed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6544,19 +9920,30 @@ "description": "An organization owner viewed the organization's SSO recovery codes.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" }, @@ -6565,19 +9952,31 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", "fields": [ - "actor", - "operation_type", "@timestamp", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "actor_is_bot", - "request_access_security_header" + "operation_type", + "created_at", + "actor_is_bot" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -6586,20 +9985,31 @@ "description": "A GitHub Actions secret was removed from an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -6608,21 +10018,31 @@ "description": "A GitHub Actions variable was removed from an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -6631,18 +10051,29 @@ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", "fields": [ - "user_id", - "user_agent", - "org_id", - "user", - "action", - "_document_id", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" @@ -6652,19 +10083,29 @@ "description": "Removed a two-factor authentication method restriction for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "two_factor_method", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "two_factor_method", "created_at", "operation_type", "actor_is_bot" @@ -6675,22 +10116,32 @@ "description": "A Codespaces or Dependabot secret was removed from an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -6698,21 +10149,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6720,21 +10180,30 @@ "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ - "org", - "user", - "org_id", - "created_at", - "request_id", "@timestamp", - "action", - "operation_type", - "user_agent", "_document_id", + "action", "actor", "actor_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -6742,21 +10211,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -6764,18 +10243,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", "fields": [ - "operation_type", - "org_id", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "actor", - "action", - "programmatic_access_type" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -6784,19 +10275,31 @@ "description": "An organization was renamed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "_document_id", "@timestamp", - "org", + "_document_id", "action", "actor", - "old_login", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_login", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -6804,14 +10307,28 @@ "description": "Triggered when a required workflow is created.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6822,14 +10339,28 @@ "description": "Triggered when a required workflow is deleted.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6840,14 +10371,28 @@ "description": "Triggered when a required workflow is updated.", "docs_reference_links": "/actions/using-workflows/required-workflows", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -6858,20 +10403,30 @@ "description": "An organization member was restored.", "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", "fields": [ - "user", - "actor", - "user_id", + "@timestamp", "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "actor_id", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" }, @@ -6880,18 +10435,29 @@ "description": "A member's linked identity was revoked.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", "user_id", - "@timestamp", - "action", - "actor_id", "user_agent", - "_document_id", - "request_id", + "operation_type", "created_at" ], "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" @@ -6901,42 +10467,65 @@ "description": "A member's SAML session was revoked.", "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "operation_type", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" + }, + { + "action": "org.runner_group_created", + "description": "A self-hosted runner group was created.", + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" - ], - "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" - }, - { - "action": "org.runner_group_created", - "description": "A self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", - "fields": [ "user_agent", - "request_id", - "actor", - "actor_id", "runner_group_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" @@ -6946,21 +10535,31 @@ "description": "A self-hosted runner group was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6969,20 +10568,31 @@ "description": "A self-hosted runner group was renamed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -6991,23 +10601,33 @@ "description": "The REST API was used to remove a self-hosted runner from a group.", "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "runner_group_id", "runner_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" }, @@ -7016,23 +10636,31 @@ "description": "A self-hosted runner was added to a group.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "runner_group_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7041,19 +10669,32 @@ "description": "A runner group's list of members was updated.", "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "runner_group_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "runner_group_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" }, @@ -7062,25 +10703,36 @@ "description": "The configuration of a self-hosted runner group was changed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_group_id", "runner_group_name", "runner_group_allow_public", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "runner_group_restricted_to_workflows", "runner_group_selected_workflow_refs", - "programmatic_access_type", - "network_configuration_id", - "request_access_security_header" + "network_configuration_id" ], "docs_reference_titles": "Managing access to self-hosted runners using groups" }, @@ -7089,21 +10741,32 @@ "description": "The visibility of a self-hosted runner group was updated via the REST API.", "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "runner_group_id", - "visibility", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "runner_group_id", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ], "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" }, @@ -7112,10 +10775,28 @@ "description": "Enablement for Secret Protection features on new repositories has been locked for this organization.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "action", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7125,10 +10806,28 @@ "description": "Enablement for Secret Protection features on new repositories has been unlocked for this organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -7138,21 +10837,30 @@ "description": "Automatic partner validation checks have been disabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -7162,21 +10870,30 @@ "description": "Automatic partner validation checks have been enabled at the organization level", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" @@ -7186,20 +10903,30 @@ "description": "A custom pattern was created for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7208,22 +10935,30 @@ "description": "A custom pattern was removed from secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7232,21 +10967,30 @@ "description": "A custom pattern was published for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7255,21 +10999,30 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7278,22 +11031,30 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7302,21 +11063,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -7325,22 +11095,30 @@ "description": "Generic secrets have been disabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -7348,22 +11126,30 @@ "description": "Generic secrets have been enabled at the organization level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -7371,21 +11157,30 @@ "description": "Secret scanning for non-provider patterns was disabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7395,21 +11190,30 @@ "description": "Secret scanning for non-provider patterns was enabled at the organization level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" @@ -7419,19 +11223,30 @@ "description": "A role or team was added to the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7441,21 +11256,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7465,21 +11289,30 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7489,19 +11322,30 @@ "description": "A role or team was removed from the push protection bypass list at the organization level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "About push protection" @@ -7511,22 +11355,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7535,22 +11387,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7559,22 +11419,30 @@ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7583,21 +11451,30 @@ "description": "Push protection for secret scanning was disabled.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7606,21 +11483,30 @@ "description": "Push protection for secret scanning was enabled.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7629,22 +11515,30 @@ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7653,22 +11547,30 @@ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "token_scopes" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -7677,12 +11579,28 @@ "description": "The push protection setting was updated for a secret type for your organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "push_protection_setting", "secret_type", "secret_type_display_name", @@ -7695,12 +11613,28 @@ "description": "The push protection pattern configuration was updated for your organization.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at" ], "docs_reference_titles": "About push protection" @@ -7710,26 +11644,35 @@ "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -7738,26 +11681,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7765,28 +11716,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7794,26 +11753,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7821,15 +11788,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -7838,15 +11822,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -7855,7 +11856,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -7870,18 +11892,28 @@ "description": "The cache retention policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -7893,18 +11925,28 @@ "description": "The cache storage policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -7916,20 +11958,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -7938,16 +11991,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -7958,18 +12024,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -7978,17 +12057,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", "_document_id", - "org_id", - "operation_type", + "action", "actor", "actor_id", - "@timestamp", - "request_id", - "created_at", + "business", + "business_id", + "hashed_token", "org", - "action" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7996,18 +12088,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -8016,18 +12120,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -8036,18 +12153,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -8056,22 +12185,32 @@ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", "actor_id", - "org_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "issuer", - "business", "operation_type", "created_at", - "request_id", - "business_id", - "_document_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8079,21 +12218,32 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Adding organizations to your enterprise" }, @@ -8102,19 +12252,30 @@ "description": "An organization was transferred between enterprise accounts.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org", - "org_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "from_business", "to_business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8125,15 +12286,28 @@ "description": "The organization was unarchived.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -8143,19 +12317,32 @@ "description": "A user was unblocked from an organization.", "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", "fields": [ - "oauth_application_id", + "@timestamp", "_document_id", - "blocked_user", "action", - "operation_type", - "@timestamp", - "request_id", - "created_at", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "blocked_user", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" }, @@ -8164,20 +12351,32 @@ "description": "A GitHub Actions secret was updated for an organization.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "created_at", "key", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -8186,23 +12385,34 @@ "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "updated_allowed_types", "old_policy", - "updated_access_policy", - "programmatic_access_type", - "request_access_security_header" + "updated_access_policy" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" }, @@ -8211,20 +12421,32 @@ "description": "A GitHub Actions variable was updated for an organization.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -8233,20 +12455,32 @@ "description": "The default repository permission level for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", + "@timestamp", + "_document_id", "action", - "operation_type", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", + "created_at", "permission", - "actor_id", - "old_permission", - "_document_id", - "programmatic_access_type" + "old_permission" ] }, { @@ -8254,18 +12488,30 @@ "description": "The settings policy for immutable releases was updated for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_policy", "new_policy", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8276,22 +12522,33 @@ "description": "A Codespaces or Dependabot secret was updated for an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -8300,20 +12557,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -8321,17 +12589,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -8341,20 +12622,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -8363,17 +12655,30 @@ "description": "The name of the default branch was changed for new repositories in the organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" }, @@ -8382,17 +12687,30 @@ "description": "The repository self-hosted runners policy was updated", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_repo_runners_policy", "new_repo_runners_policy", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8403,19 +12721,32 @@ "description": "An organization's SAML provider settings were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "sso_url", - "actor_id", - "operation_type", "@timestamp", - "issuer", - "org", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "sso_url", + "operation_type", + "issuer", + "created_at" ] }, { @@ -8423,18 +12754,30 @@ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", "fields": [ - "request_id", - "org_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "_document_id", - "org", - "action", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" }, @@ -8443,21 +12786,31 @@ "description": "An organization's custom property value was manually set for the first time.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8469,21 +12822,31 @@ "description": "An organization's custom property value was deleted.", "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "definition_id", "property_name", "value", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8495,18 +12858,30 @@ "description": "A default label was created for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", "fields": [ - "request_id", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "operation_type", - "_document_id", - "action", - "created_at", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" }, @@ -8515,17 +12890,30 @@ "description": "A default label was deleted for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", "fields": [ - "operation_type", - "request_id", - "actor", "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" }, @@ -8534,17 +12922,30 @@ "description": "A default label was edited for repositories in an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", "fields": [ - "org", - "created_at", "@timestamp", - "actor", + "_document_id", "action", - "user_agent", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" }, @@ -8553,20 +12954,33 @@ "description": "A domain was approved for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "org_id", - "business_id", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" }, @@ -8575,16 +12989,31 @@ "description": "A domain was added to an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ - "created_at", + "@timestamp", "_document_id", - "domain_name", "action", - "request_id", + "actor", "actor_id", - "operation_type", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "domain_name", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8593,14 +13022,29 @@ "description": "A domain was removed from an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", "fields": [ - "action", - "domain_name", "@timestamp", "_document_id", - "user_agent", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "domain_name", "operation_type", "created_at" ], @@ -8611,16 +13055,31 @@ "description": "A domain was verified for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "domain_name", - "@timestamp", - "user_agent", - "request_id", - "actor", - "action", - "created_at", - "_document_id", - "actor_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" }, @@ -8629,16 +13088,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -8648,17 +13120,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -8668,16 +13151,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", "created_at", "operation_type" ] @@ -8687,20 +13183,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -8708,19 +13214,30 @@ "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor", - "business_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", "user_agent", - "_document_id", "created_at", - "operation_type", - "request_id", - "business" + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -8729,19 +13246,30 @@ "description": "Organization projects were disabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "operation_type", - "@timestamp", - "actor", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -8750,18 +13278,29 @@ "description": "Organization projects were enabled for all organizations in an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", "fields": [ - "actor_id", - "org_id", - "created_at", - "user_id", - "org", "@timestamp", "_document_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", + "user_agent", + "created_at", "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" @@ -8771,23 +13310,33 @@ "description": "An organization role was assigned to a user or team.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About custom organization roles" }, @@ -8796,25 +13345,32 @@ "description": "A custom organization role was created in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -8826,25 +13382,32 @@ "description": "A custom organization role was deleted in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor", - "actor_id", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -8855,19 +13418,30 @@ "description": "A user or team was unassigned an organization role.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "organization_role_id", - "organization_role_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "organization_role_id", + "organization_role_name", "created_at", "operation_type" ], @@ -8878,26 +13452,33 @@ "description": "A custom organization role was edited in an organization.", "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", "old_role_permissions", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -8910,22 +13491,33 @@ "description": "An organization's default project base role was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_project_base_role", - "new_project_base_role", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_project_base_role", + "new_project_base_role", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8933,20 +13525,31 @@ "description": "An entire package was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" @@ -8956,23 +13559,34 @@ "description": "A package was published or republished to an organization.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "ecosystem", "version_count", "is_republished", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -8981,21 +13595,32 @@ "description": "A specific package version was deleted.", "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "package", "version", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "ecosystem", "actor_is_bot" ], @@ -9006,21 +13631,34 @@ "description": "A specific package version was published or republished to a package.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "ecosystem", "package", "version", - "actor_id", - "user_agent", "is_republished", - "actor", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", "actor_is_bot" ] }, @@ -9029,20 +13667,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -9051,17 +13703,32 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9072,20 +13739,34 @@ "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -9094,18 +13775,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9113,16 +13806,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -9130,18 +13837,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -9149,18 +13868,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9171,22 +13903,31 @@ "description": "The configured restriction for access to resources via personal access tokens was disabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9194,22 +13935,31 @@ "description": "The configured restriction for access to resources via personal access tokens was enabled.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9217,18 +13967,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -9239,18 +14002,28 @@ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9261,18 +14034,28 @@ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -9283,23 +14066,34 @@ "description": "A personal access token expiration limit was set.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "token_expiration", "old_token_expiration", "exempt_administrators", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9307,21 +14101,32 @@ "description": "A personal access token expiration limit was unset.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "programmatic_access_type", - "old_token_expiration", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_token_expiration", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9329,17 +14134,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9350,18 +14168,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9373,17 +14204,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -9395,20 +14239,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was created.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9420,20 +14273,29 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9445,20 +14307,29 @@ "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", - "repository", - "repository_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "branch", "created_at", "operation_type", "public_repo" @@ -9470,40 +14341,64 @@ "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "branch", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "branch", + "created_at", + "operation_type", + "public_repo" + ], + "docs_reference_titles": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + }, + { + "action": "premium_runner.create", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" - }, - { - "action": "premium_runner.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ "user_agent", - "request_id", - "actor", - "actor_id", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9513,17 +14408,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -9533,15 +14439,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -9551,19 +14472,30 @@ "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "action", - "operation_type", "@timestamp", - "business_id", + "_document_id", + "action", + "actor", "actor_id", - "user", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "created_at", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9571,23 +14503,30 @@ "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "created_at", - "actor_id", + "@timestamp", "_document_id", - "actor", - "user", - "repo", "action", - "user_agent", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "request_id", - "user_id", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -9595,23 +14534,30 @@ "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_id", - "operation_type", + "@timestamp", "_document_id", "action", - "@timestamp", - "repo", - "org", - "business", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org_id", - "created_at", - "business_id" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9619,17 +14565,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9639,17 +14596,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9659,17 +14627,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9679,17 +14658,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -9699,17 +14689,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", + "user_agent", "created_at", "owner", - "action", - "_document_id", - "request_id", - "user_agent", - "actor", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -9719,17 +14722,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -9737,25 +14753,36 @@ "description": "A project's base role was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "old_project_base_role", "new_project_base_role", "project_number", "public_project", - "business", "project_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9763,20 +14790,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -9786,25 +14824,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -9812,20 +14862,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9833,25 +14895,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -9859,17 +14933,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -9877,17 +14964,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -9895,18 +14995,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -9915,18 +15027,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -9935,19 +15059,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -9955,17 +15090,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -9977,22 +15125,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -10000,19 +15157,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -10020,17 +15188,30 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -10038,18 +15219,31 @@ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "org_id", - "operation_type", - "org", - "actor_id", - "_document_id", - "request_id", - "team", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -10057,20 +15251,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -10078,18 +15282,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -10098,18 +15314,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -10118,16 +15346,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -10139,21 +15380,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -10161,22 +15414,32 @@ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", "fields": [ - "repo", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "name", "created_at", - "_document_id", "operation_type", - "actor", - "repo_id", - "org", - "request_id", - "actor_id", - "oauth_application_id", - "@timestamp", - "programmatic_access_type" + "oauth_application_id" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" }, @@ -10185,29 +15448,34 @@ "description": "A protected branch allowance was given to a specific user, team or integration.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "authorized_actors", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -10215,24 +15483,32 @@ "description": "Branch protection was enabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "repo_id", - "user_id", "@timestamp", - "user_agent", - "repo", - "name", - "org_id", - "user", "_document_id", - "request_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", "created_at", "authorized_actor_names", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -10243,21 +15519,31 @@ "description": "Branch protection was disabled on a branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "repo", "@timestamp", + "_document_id", + "action", "actor", - "org", "actor_id", - "request_id", - "repo_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "name", + "operation_type", "created_at", - "_document_id", - "token_scopes", "required_deployments_enforcement_level", "merge_queue_enforcement_level", "create_protected" @@ -10268,22 +15554,32 @@ "description": "Enforcement of dismissing stale pull requests was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "dismiss_stale_reviews_on_push", - "org_id", - "action", - "created_at", - "request_id", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "dismiss_stale_reviews_on_push", + "created_at", "operation_type", - "actor", - "repo", - "org", - "name", - "programmatic_access_type" + "name" ] }, { @@ -10291,24 +15587,34 @@ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "authorized_actors_only", "authorized_actors", "created_at", - "user_agent", "name", - "_document_id", - "org_id", - "request_id", - "@timestamp", - "actor_id", - "org", - "action", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -10316,30 +15622,37 @@ "description": "A branch protection requirement was overridden by a repository administrator.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "actor", "reasons", - "@timestamp", "before", "after", - "actor_id", - "repo", "operation_type", - "user_agent", "branch", "overridden_codes", - "org", - "org_id", - "action", - "_document_id", - "request_id", "referrer", - "business", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "rule_suite_id" ] @@ -10349,28 +15662,36 @@ "description": "A branch update attempt was rejected.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", "org_id", - "operation_type", - "request_id", + "programmatic_access_type", + "repo", "repo_id", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "branch", "before", "overridden_codes", "after", - "action", "reasons", - "actor_id", - "business_id", "deploy_key_fingerprint", - "token_scopes", - "programmatic_access_type", "compliant_pull_request_ids", "actor_is_bot", "rule_suite_id" @@ -10381,23 +15702,32 @@ "description": "Branch protection was enforced for repository administrators.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "admin_enforced", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "name", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "action", "repo_id", - "org_id", - "_document_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "admin_enforced", + "operation_type", + "name", + "created_at" ] }, { @@ -10405,22 +15735,32 @@ "description": "Branch deletion was enabled or disabled for a protected branch.", "docs_reference_links": "N/A", "fields": [ - "name", - "operation_type", - "request_id", - "repo", "@timestamp", - "org_id", - "org", - "action", - "allow_deletions_enforcement_level", "_document_id", - "created_at", - "actor_id", - "user_agent", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_deletions_enforcement_level", + "created_at" ] }, { @@ -10428,23 +15768,32 @@ "description": "Force pushes were enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "actor_id", - "name", + "@timestamp", "_document_id", + "action", "actor", - "repo", - "operation_type", - "request_id", - "allow_force_pushes_enforcement_level", - "@timestamp", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "created_at", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "allow_force_pushes_enforcement_level", + "created_at" ] }, { @@ -10452,24 +15801,33 @@ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "ignore_approvals_from_contributors", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -10478,22 +15836,32 @@ "description": "Required linear commit history was enabled or disabled for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "operation_type", "actor", - "linear_history_requirement_enforcement_level", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "linear_history_requirement_enforcement_level", "name", - "org_id", - "repo_id", - "org", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ] }, { @@ -10501,24 +15869,33 @@ "description": "Fork syncing was enabled or disabled for a read-only branch", "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "lock_allows_fetch_and_merge", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -10527,27 +15904,34 @@ "description": "The enforcement of a branch lock was updated.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "enforcement_level", "lock_branch_enforcement_level", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" }, @@ -10556,18 +15940,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -10578,24 +15975,33 @@ "description": "A branch name pattern was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "old_name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "old_name", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -10603,25 +16009,32 @@ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", "docs_reference_links": "N/A", "fields": [ - "name", - "org_id", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", - "@timestamp", + "business", "business_id", - "request_id", - "pull_request_reviews_enforcement_level", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "action", - "business", - "user_agent", - "created_at", "repo_id", - "operation_type", - "actor", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "pull_request_reviews_enforcement_level", + "created_at", + "operation_type" ] }, { @@ -10629,22 +16042,32 @@ "description": "Enforcement of required code owner review was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "org_id", - "created_at", - "require_code_owner_review", - "operation_type", - "name", - "user_agent", - "action", "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "request_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "require_code_owner_review", + "operation_type", + "name" ] }, { @@ -10652,22 +16075,33 @@ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "require_last_push_approval", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" }, @@ -10676,22 +16110,32 @@ "description": "Enforcement of the required number of approvals before merging was updated on a branch.", "docs_reference_links": "N/A", "fields": [ - "required_approving_review_count", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "required_approving_review_count", "created_at", - "actor", "operation_type", - "user_agent", - "name", - "org_id", - "action", - "actor_id", - "_document_id", - "org", - "@timestamp", - "programmatic_access_type" + "name" ] }, { @@ -10699,25 +16143,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "user_agent", "@timestamp", "_document_id", - "name", - "repo", "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "business", - "actor_id", - "operation_type", - "created_at", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "required_status_checks_enforcement_level", - "org", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at", + "required_status_checks_enforcement_level" ] }, { @@ -10725,22 +16176,32 @@ "description": "Enforcement of required commit signing was updated for a branch.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "name", - "@timestamp", "created_at", - "_document_id", - "request_id", - "repo_id", - "org", - "org_id", - "action", - "actor", - "actor_id", - "signature_requirement_enforcement_level", - "repo", - "user_agent", - "programmatic_access_type" + "signature_requirement_enforcement_level" ] }, { @@ -10748,22 +16209,32 @@ "description": "Enforcement of required status checks was updated for a branch.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "@timestamp", - "created_at", - "repo_id", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", "name", - "actor", - "repo", "operation_type", - "action", - "strict_required_status_checks_policy", - "programmatic_access_type" + "strict_required_status_checks_policy" ] }, { @@ -10771,23 +16242,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -10796,24 +16278,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -10822,20 +16315,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10844,21 +16351,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -10868,22 +16388,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10892,25 +16424,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10919,23 +16461,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", - "created_at", - "key", - "fingerprint", - "actor_id", "actor", - "title", - "user_agent", - "user_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "read_only", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "key", + "fingerprint", + "title", + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -10944,18 +16497,32 @@ "description": "A pull request was closed without being merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" @@ -10965,21 +16532,32 @@ "description": "A pull request was converted to a draft.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" }, @@ -10988,19 +16566,32 @@ "description": "A pull request was created.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -11011,23 +16602,35 @@ "description": "A review was requested on a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -11037,17 +16640,31 @@ "description": "A pull request was marked as in progress.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11055,19 +16672,32 @@ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -11075,19 +16705,32 @@ "description": "A pull request was merged.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" @@ -11097,21 +16740,32 @@ "description": "A pull request was marked as ready for review.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" }, @@ -11120,27 +16774,34 @@ "description": "A pull request was rebased.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "pull_request_url", "pull_request_title", - "user", - "user_id", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -11148,23 +16809,35 @@ "description": "A review request was removed from a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "reviewer_type", "reviewer", "reviewer_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" }, @@ -11173,18 +16846,32 @@ "description": "A pull request was reopened after previously being closed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ] }, { @@ -11192,19 +16879,31 @@ "description": "A review comment was added to a pull request.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "comment_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" @@ -11214,20 +16913,31 @@ "description": "A review comment on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "actor", "@timestamp", "_document_id", - "repo", - "created_at", - "request_id", - "comment_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "comment_id", + "operation_type" ] }, { @@ -11235,18 +16945,31 @@ "description": "A review comment on a pull request was changed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "request_id", - "actor_id", + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "_document_id", - "@timestamp", - "comment_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "comment_id" ] }, { @@ -11254,21 +16977,33 @@ "description": "A review on a pull request was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "pull_request_url" ] }, { @@ -11276,20 +17011,33 @@ "description": "A review on a pull request was dismissed.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "pull_request_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "pull_request_url", - "programmatic_access_type" + "pull_request_url" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" }, @@ -11298,19 +17046,33 @@ "description": "A review on a pull request was submitted.", "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "review_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "pull_request_url", - "programmatic_access_type", "actor_is_agent" ], "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" @@ -11320,22 +17082,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -11344,21 +17116,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -11367,25 +17148,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -11394,23 +17182,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -11419,24 +17215,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -11445,23 +17248,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -11471,22 +17282,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -11495,19 +17315,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -11516,24 +17349,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -11542,24 +17385,32 @@ "description": "Autofix for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11567,24 +17418,32 @@ "description": "Autofix for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11592,24 +17451,32 @@ "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11617,24 +17484,32 @@ "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -11642,23 +17517,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -11669,17 +17553,29 @@ "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -11689,17 +17585,29 @@ "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -11709,25 +17617,31 @@ "description": "Code scanning using the default setup was disabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -11736,26 +17650,34 @@ "description": "Code scanning using the default setup was enabled for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "query_suite", "threat_model", - "languages", - "request_access_security_header" + "languages" ], "docs_reference_titles": "Configuring default setup for code scanning" }, @@ -11764,25 +17686,34 @@ "description": "Code scanning using the default setup was updated for a repository.", "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "query_suite", "threat_model", "languages", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Configuring default setup for code scanning" @@ -11792,19 +17723,30 @@ "description": "GitHub Codespaces was granted trusted repository access to this repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -11813,19 +17755,30 @@ "description": "GitHub Codespaces trusted repository access to this repository was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -11833,17 +17786,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11852,15 +17818,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -11871,16 +17850,29 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "@timestamp", "created_at", - "actor_id", - "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11890,17 +17882,30 @@ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -11910,19 +17915,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11931,17 +17947,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -11950,26 +17979,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -11978,30 +18013,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -12010,21 +18050,32 @@ "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", - "fields": [ - "user_agent", - "request_id", + "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12033,25 +18084,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12060,23 +18119,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -12084,25 +18154,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -12112,23 +18191,32 @@ "description": "A source code archive of a repository was downloaded as a ZIP file.", "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "created_at", "operation_type", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" @@ -12138,24 +18226,32 @@ "description": "The setting for immutable releases was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -12164,20 +18260,30 @@ "description": "The setting for immutable releases was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -12188,23 +18294,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -12212,21 +18328,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", + "@timestamp", "_document_id", - "user_id", - "visibility", "action", - "user_agent", - "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "programmatic_access_type" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -12234,21 +18360,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -12256,22 +18392,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -12279,21 +18424,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -12301,20 +18456,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -12322,22 +18488,31 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "operation_type", + "created_at" ] }, { @@ -12345,18 +18520,32 @@ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ - "visibility", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -12364,22 +18553,32 @@ "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -12387,21 +18586,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -12409,18 +18618,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -12429,22 +18650,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -12453,24 +18683,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -12479,23 +18717,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -12503,26 +18751,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -12531,21 +18784,30 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Removing self-hosted runners" }, @@ -12554,25 +18816,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -12580,22 +18848,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -12604,25 +18882,34 @@ "description": "A branch was renamed.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "old_branch", - "new_branch", - "default_branch", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "old_branch", + "new_branch", + "default_branch", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch" @@ -12632,19 +18919,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -12652,17 +18950,32 @@ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -12671,17 +18984,32 @@ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", "fields": [ - "repo_id", - "repo", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", - "action", - "_document_id", "operation_type", - "created_at", - "@timestamp" + "created_at" ], "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" }, @@ -12690,7 +19018,28 @@ "description": "The runner application was updated. This event is not included in the JSON/CSV export.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "runner_id", "runner_name", "source_version", @@ -12705,22 +19054,30 @@ "description": "The cache retention policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -12732,22 +19089,30 @@ "description": "The cache storage policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -12759,23 +19124,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -12785,20 +19159,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -12809,21 +19194,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -12832,22 +19228,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -12856,21 +19262,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -12879,22 +19296,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -12905,16 +19332,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -12924,22 +19362,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -12948,23 +19397,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -12974,19 +19433,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -12994,21 +19463,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -13017,24 +19496,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -13042,25 +19530,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -13069,24 +19564,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13095,25 +19600,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -13122,22 +19635,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13146,26 +19668,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -13173,31 +19703,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13206,22 +19743,30 @@ "description": "Someone closed a security advisory.", "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", "fields": [ - "actor", - "repo", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", - "user_agent", - "actor_id", - "request_id", - "action", - "operation_type", - "created_at", - "repo_id", - "_document_id", + "hashed_token", "org", "org_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "About repository security advisories" }, @@ -13230,18 +19775,29 @@ "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "repo_id", - "repo", - "org_id", - "actor", + "@timestamp", + "_document_id", "action", - "request_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "_document_id", + "operation_type", "created_at" ] }, @@ -13250,17 +19806,30 @@ "description": "GitHub made a security advisory public in the GitHub Advisory Database.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ] }, @@ -13269,21 +19838,30 @@ "description": "GitHub withdrew a security advisory that was published in error.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", - "actor", - "actor_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -13291,18 +19869,30 @@ "description": "Someone opened a draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", "repo_id", - "action", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13310,21 +19900,30 @@ "description": "Someone published a security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "actor_id", "@timestamp", - "actor", - "repo_id", "_document_id", - "repo", - "business_id", - "business", - "request_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "org" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -13332,17 +19931,30 @@ "description": "Someone reopened as draft security advisory.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_agent", - "repo", - "action", - "created_at", "@timestamp", - "request_id", - "actor_id", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "public_repo" ] }, @@ -13351,21 +19963,30 @@ "description": "Someone edited a draft or published security advisory.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "repo_id", - "org_id", "business", - "actor", - "user_agent", - "created_at", - "_document_id", "business_id", - "repo", - "action", - "operation_type", + "hashed_token", "org", - "@timestamp", - "request_id" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -13373,24 +19994,30 @@ "description": "Branch protections were disabled for the repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -13399,24 +20026,30 @@ "description": "Branch protections were enabled for this repository.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" }, @@ -13425,25 +20058,31 @@ "description": "Code security was disabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -13452,25 +20091,31 @@ "description": "Code security was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -13479,19 +20124,30 @@ "description": "Data use settings were disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "repo_id", - "request_id", - "actor_id", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "_document_id" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -13500,21 +20156,30 @@ "description": "Data use settings were enabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "user", - "org", - "user_id", - "repo_id", "@timestamp", - "request_id", - "actor", + "_document_id", "action", - "operation_type", - "created_at", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org_id", - "_document_id" + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -13523,23 +20188,30 @@ "description": "The dependency graph was disabled for a private repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", "fields": [ - "repo_id", - "operation_type", - "user_id", - "repo", + "@timestamp", "_document_id", - "actor", - "user", "action", - "@timestamp", - "org_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "user_agent", - "request_id", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" }, @@ -13548,24 +20220,31 @@ "description": "The dependency graph was enabled for a private repository.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor_id", - "repo_id", + "created_at", "operation_type", - "actor", - "@timestamp", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -13574,21 +20253,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -13596,21 +20285,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -13618,21 +20317,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -13640,20 +20350,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -13661,21 +20383,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -13683,19 +20416,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "actor", - "invitee", - "action", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -13703,17 +20449,31 @@ "description": "An organization has reached their repository limit.", "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "limit", "count", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -13724,17 +20484,31 @@ "description": "An organization is approaching their repository limit.", "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "limit", "count", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -13745,19 +20519,30 @@ "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", "fields": [ - "request_id", - "created_at", + "@timestamp", "_document_id", "action", - "user_agent", - "user", - "business_id", - "business", - "operation_type", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Enforcing policies for projects in your enterprise" }, @@ -13766,20 +20551,30 @@ "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "created_at", "@timestamp", - "repo", - "action", - "operation_type", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "repo_id", - "actor", - "request_id", - "programmatic_access_type" + "created_at", + "operation_type" ] }, { @@ -13788,20 +20583,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", "created_at", - "org_id", - "action", - "user_id", - "operation_type", - "_document_id", - "actor_id", - "repo" + "operation_type" ] }, { @@ -13809,31 +20613,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -13842,19 +20654,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -13862,8 +20685,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -13872,23 +20694,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -13913,26 +20744,32 @@ "description": "Automatic partner validation checks have been disabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -13941,26 +20778,32 @@ "description": "Automatic partner validation checks have been enabled at the repository level", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" }, @@ -13969,23 +20812,30 @@ "description": "A custom pattern was created for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -13995,23 +20845,30 @@ "description": "A custom pattern was removed from secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14021,24 +20878,31 @@ "description": "A custom pattern was published for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14048,24 +20912,31 @@ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Defining custom patterns for secret scanning" }, @@ -14074,24 +20945,31 @@ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14101,23 +20979,30 @@ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "Defining custom patterns for secret scanning" @@ -14127,23 +21012,31 @@ "description": "Secret scanning was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "public_repo", - "programmatic_access_type" + "public_repo" ], "docs_reference_titles": "About secret scanning" }, @@ -14152,22 +21045,30 @@ "description": "Secret scanning was enabled for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14175,24 +21076,32 @@ "description": "Generic secrets have been disabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14200,22 +21109,31 @@ "description": "Generic secrets have been enabled at the repository level", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -14224,24 +21142,32 @@ "description": "Secret scanning for non-provider patterns was disabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -14250,24 +21176,32 @@ "description": "Secret scanning for non-provider patterns was enabled at the repository level.", "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Supported secret scanning patterns" }, @@ -14276,19 +21210,31 @@ "description": "A role or team was added to the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -14297,24 +21243,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -14323,24 +21277,32 @@ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -14349,19 +21311,31 @@ "description": "A role or team was removed from the push protection bypass list at the repository level.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "About push protection" }, @@ -14370,26 +21344,31 @@ "description": "Secret scanning push protection was disabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -14398,26 +21377,31 @@ "description": "Secret scanning push protection was enabled for a repository.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "About push protection" }, @@ -14426,28 +21410,36 @@ "description": "A code security configuration was applied to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14455,27 +21447,35 @@ "description": "A code security configuration failed to attach to the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14483,28 +21483,36 @@ "description": "A code security configuration was removed from a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14512,28 +21520,36 @@ "description": "A code security configuration was removed due to a change in repository or enterprise settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "repository_security_configuration_state", "repository_security_configuration_failure_reason", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14541,20 +21557,30 @@ "description": "The repository visibility change setting was cleared for an organization or enterprise.", "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", "fields": [ - "created_at", + "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", "business", - "action", - "operation_type", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "business_id", - "@timestamp", "user_agent", - "actor", - "request_access_security_header" + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise" }, @@ -14563,20 +21589,30 @@ "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "user", - "org_id", - "created_at", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", - "_document_id", - "@timestamp", - "user_id", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14584,19 +21620,30 @@ "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", "docs_reference_links": "N/A", "fields": [ - "actor", - "operation_type", - "_document_id", "@timestamp", - "user_agent", - "user", - "created_at", - "org", - "org_id", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "request_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -14604,29 +21651,37 @@ "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -14635,29 +21690,37 @@ "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", - "action", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "request_access_security_header" + "vulnerability_alert_rule_name" ], "docs_reference_titles": "About Dependabot auto-triage rules" }, @@ -14666,19 +21729,32 @@ "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", "fields": [ - "operation_type", - "request_id", - "repo_id", "@timestamp", - "user_agent", - "alert_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "alert_id", + "created_at", + "alert_number" ], "docs_reference_titles": "About Dependabot alerts" }, @@ -14687,23 +21763,32 @@ "description": "A Dependabot alert was manually dismissed.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", - "operation_type", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "operation_type", "alert_id", - "actor", - "repo", "created_at", - "org", - "_document_id", - "action", - "actor_id", "dismiss_reason", - "user", "dismiss_comment", "alert_number", "actor_is_bot" @@ -14714,21 +21799,33 @@ "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "public_repo", "owner", - "_document_id", - "@timestamp", "operation_type", - "token_scopes", "alert_number" ] }, @@ -14737,26 +21834,34 @@ "description": "A Dependabot alert was manually reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "alert_id", - "created_at", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "alert_id", + "created_at", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type", - "business", - "business_id", "public_repo", - "alert_number", - "request_access_security_header" + "alert_number" ] }, { @@ -14764,21 +21869,32 @@ "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", "docs_reference_links": "N/A", "fields": [ - "alert_id", - "repo", - "operation_type", - "action", - "repo_id", - "_document_id", - "user_agent", - "request_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "alert_number", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "alert_id", + "operation_type", + "created_at", + "alert_number" ] }, { @@ -14786,21 +21902,35 @@ "description": "A Dependabot alert was withdrawn.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "alert_id", "alert_number", "ghsa_id", "created_at", "active", - "action", - "repository_id", - "repo", - "repo_id", "public_repo", "owner", - "org", - "org_id", - "_document_id", - "@timestamp", "operation_type" ] }, @@ -14809,20 +21939,30 @@ "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", "fields": [ - "org", + "@timestamp", "_document_id", - "repo", - "org_id", - "operation_type", - "created_at", - "actor", "action", - "@timestamp", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" }, @@ -14831,24 +21971,31 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -14856,26 +22003,32 @@ "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -14883,23 +22036,30 @@ "description": "Dependabot alerts was disabled.", "docs_reference_links": "N/A", "fields": [ - "repo", - "request_id", - "repo_id", - "action", - "actor_id", "@timestamp", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "org", - "_document_id", "user_id", - "operation_type", - "token_scopes", - "programmatic_access_type" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -14907,23 +22067,30 @@ "description": "Dependabot alerts was enabled.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_agent", - "created_at", "@timestamp", - "repo_id", + "_document_id", "action", - "user", - "repo", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor_id", - "_document_id", - "user_id", - "operation_type", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", "actor_is_bot" ] }, @@ -14932,24 +22099,31 @@ "description": "A status check was marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "org", - "actor_id", "@timestamp", - "business", - "request_id", - "context", - "repo_id", - "action", - "repo", "_document_id", - "operation_type", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", "org_id", - "actor", - "created_at", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "context", + "operation_type", + "created_at" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -14958,21 +22132,31 @@ "description": "A status check was no longer marked as required for a protected branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", "fields": [ - "actor_id", - "actor", - "created_at", - "context", - "operation_type", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "repo_id", "org_id", - "action", - "_document_id", + "programmatic_access_type", "repo", - "programmatic_access_type" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "context", + "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" }, @@ -14981,18 +22165,31 @@ "description": "Email notification restrictions for an organization or enterprise were disabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -15001,19 +22198,31 @@ "description": "Email notification restrictions for an organization or enterprise were enabled.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "business_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" }, @@ -15022,22 +22231,33 @@ "description": "A new custom repository role was created.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "name", - "owner", - "base_role", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "owner", + "base_role", "operation_type", - "@timestamp", - "_document_id", "role_permissions", "old_role_permissions" ], @@ -15048,23 +22268,34 @@ "description": "A custom repository role was deleted.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ], "docs_reference_titles": "Managing custom repository roles for an organization" }, @@ -15073,23 +22304,34 @@ "description": "A custom repository role was edited.", "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "owner", "role_permissions", "base_role", - "org", - "org_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "old_role_permissions", "old_base_role" ], @@ -15100,14 +22342,28 @@ "description": "A user was assigned to a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15122,14 +22378,28 @@ "description": "GitHub detected a secret and created a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15143,14 +22413,28 @@ "description": "A secret scanning alert was deleted by GitHub.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15166,14 +22450,28 @@ "description": "A secret scanning alert was leaked in a public repo.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15188,22 +22486,32 @@ "description": "A secret scanning alert was reopened.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type_display_name" ] }, @@ -15212,14 +22520,28 @@ "description": "A leaked secret was reported to the secret's provider by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "created_at", @@ -15234,28 +22556,37 @@ "description": "A secret scanning alert was resolved.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "number", - "resolution", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", + "resolution", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "token_scopes", "secret_type", "secret_type_display_name", "publicly_leaked", - "multi_repo", - "request_access_security_header" + "multi_repo" ] }, { @@ -15263,25 +22594,32 @@ "description": "A secret scanning alert was revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", - "number", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -15289,14 +22627,28 @@ "description": "A user was unassigned from a secret scanning alert.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "secret_type", "secret_type_display_name", @@ -15311,14 +22663,28 @@ "description": "A secret scanning alert was validated.", "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "previous_validity", @@ -15335,26 +22701,34 @@ "description": "A request to close a secret scanning alert was approved by a user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "request_reviewer_comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15363,25 +22737,33 @@ "description": "N/A", "docs_reference_links": "A reqeust to close a secret scanning alert was canceled by a user.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "A, reqeust, to, close, a, secret, scanning, alert, was, canceled, by, a, user." @@ -15391,27 +22773,35 @@ "description": "N/A", "docs_reference_links": "A user requested to close a secret scanning alert.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "reason", "comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "A, user, requested, to, close, a, secret, scanning, alert." @@ -15421,26 +22811,34 @@ "description": "A request to close a secret scanning alert was denied by a user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "alert_number", "request_reviewer_comment", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15449,19 +22847,30 @@ "description": "Secret scanning was disabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -15470,19 +22879,30 @@ "description": "Secret scanning was enabled for all existing repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -15491,20 +22911,30 @@ "description": "Secret scanning was disabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "actor_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "About secret scanning" }, @@ -15513,19 +22943,30 @@ "description": "Secret scanning was enabled for all new repositories.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "About secret scanning" }, @@ -15534,14 +22975,28 @@ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", "fields": [ - "repo_id", - "repo", - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "org_id", - "org", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "number", "created_at", "push_protection_bypass_reason", @@ -15559,25 +23014,33 @@ "description": "A request to bypass secret scanning push protection was approved by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "About push protection" }, @@ -15586,24 +23049,32 @@ "description": "A user canceled a request to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" @@ -15613,24 +23084,32 @@ "description": "A user pushed a commit containing a secret for which there is an approved secret scanning push protection bypass request.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" @@ -15640,25 +23119,33 @@ "description": "A request to bypass secret scanning push protection was denied by a user.", "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", - "request_access_security_header", "request_reviewer_comment" ], "docs_reference_titles": "About push protection" @@ -15668,25 +23155,33 @@ "description": "A user requested to bypass secret scanning push protection.", "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" }, @@ -15695,22 +23190,35 @@ "description": "A secret scanning scan has completed on this repository.", "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", "fields": [ - "repo_id", - "org_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "source", "type", "source_slug", "type_slug", "started_at", "completed_at", - "repo", "public_repo", - "org", - "business", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "secret_types", @@ -15724,10 +23232,28 @@ "description": "A security configuration was created", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15742,15 +23268,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -15768,22 +23287,33 @@ "description": "A default security configuration setting for new repositories was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15792,22 +23322,33 @@ "description": "A default security configuration setting for new repositories was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "default_for_new_private_repos", "default_for_new_public_repos", "security_configuration_name", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -15816,10 +23357,28 @@ "description": "A security configuration was deleted", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15834,15 +23393,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -15859,15 +23411,30 @@ "description": "A security configuration policy was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "enforcement", "security_configuration_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15877,10 +23444,28 @@ "description": "A security configuration was updated", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "security_configuration_id", "security_configuration_name", "security_configuration_description", @@ -15895,15 +23480,8 @@ "security_configuration_secret_scanning", "security_configuration_secret_scanning_push_protection", "security_configuration_secret_scanning_validity_checks", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot", "security_configuration_dependency_graph_autosubmit_action", "security_configuration_secret_scanning_non_provider_patterns", @@ -15921,16 +23499,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15940,18 +23531,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -15960,16 +23564,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -15979,15 +23596,28 @@ "description": "An agreement for invoiced billing for GitHub Sponsors was signed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "org_id", + "business", + "business_id", + "hashed_token", "org", - "action", - "_document_id", - "@timestamp", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ], @@ -15999,15 +23629,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -16017,15 +23660,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -16034,17 +23692,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -16053,17 +23724,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -16072,16 +23757,29 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "created_at", + "token_id", + "token_scopes", "user", - "_document_id", + "user_id", "user_agent", - "actor", + "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" @@ -16091,14 +23789,29 @@ "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -16108,17 +23821,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -16127,17 +23853,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -16146,18 +23885,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16166,15 +23918,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -16184,16 +23950,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action", + "user_id", "user_agent", - "operation_type", - "_document_id", - "actor", - "actor_id", - "user_id" + "created_at", + "operation_type" ] }, { @@ -16201,15 +23980,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -16220,16 +24012,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -16239,17 +24044,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -16260,17 +24078,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -16281,18 +24112,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16302,16 +24144,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16321,16 +24176,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -16342,17 +24210,30 @@ "fields": [ "@timestamp", "_document_id", - "fingerprint", - "operation_type", - "openssh_public_key", - "org_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "request_id" + "fingerprint", + "operation_type", + "openssh_public_key", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16361,19 +24242,32 @@ "description": "An SSH certificate authority for an organization or enterprise was deleted.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "created_at", + "@timestamp", "_document_id", - "fingerprint", - "operation_type", + "action", "actor", - "org_id", - "openssh_public_key", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "action", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", - "@timestamp", - "request_id" + "created_at", + "fingerprint", + "operation_type", + "openssh_public_key" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16382,21 +24276,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", "operation_type", - "_document_id", - "request_id", - "org", - "org_id", - "created_at", - "actor", - "action", - "user_id", - "business", - "business_id", - "@timestamp", - "actor_id" + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16405,19 +24308,30 @@ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", "fields": [ - "actor_id", - "user_id", - "org", - "operation_type", - "request_id", "@timestamp", "_document_id", - "actor", - "user", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "created_at", - "user_agent" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" }, @@ -16426,15 +24340,28 @@ "description": "Dependabot encrypted config was read.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "public_repo" @@ -16445,20 +24372,34 @@ "description": "The verification code expiry time for an organization or enterprise domain was set.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner_type", "domain_name", - "business_id", "token_expires_at", "owner", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16466,18 +24407,33 @@ "description": "An organization or enterprise domain was unverified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "owner_type", "domain_name", "owner", - "action", - "operation_type", - "@timestamp", - "_document_id" + "operation_type" ] }, { @@ -16485,16 +24441,31 @@ "description": "An organization or enterprise domain was verified.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "domain_name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -16502,23 +24473,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16526,23 +24507,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16550,23 +24541,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16574,23 +24575,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -16598,21 +24609,31 @@ "description": "A member of an organization was added to a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", "fields": [ - "user_agent", - "request_id", - "org_id", - "user_id", - "team", - "user", "@timestamp", - "actor_id", - "created_at", - "operation_type", "_document_id", - "org", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "created_at", + "operation_type", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" @@ -16622,22 +24643,31 @@ "description": "A team was given access and permissions to a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "team", - "action", - "operation_type", - "request_id", - "created_at", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", - "actor_id", - "_document_id", "repo_id", - "user_agent", - "org_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -16646,20 +24676,30 @@ "description": "A team was added to an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team_type", "team", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -16670,20 +24710,31 @@ "description": "A child team was created or a child team's parent was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", "fields": [ - "org", "@timestamp", - "created_at", "_document_id", - "team", "action", - "operation_type", "actor", - "request_id", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", + "operation_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" }, @@ -16692,18 +24743,31 @@ "description": "A team's privacy level was changed.", "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", "fields": [ - "user_agent", - "request_id", - "org", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team", "created_at", "operation_type", - "actor_id", - "org_id", - "@timestamp", - "actor", - "_document_id", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" @@ -16713,21 +24777,32 @@ "description": "A new team is created.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "oauth_application_id", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "oauth_application_id", + "operation_type", "team", - "org", - "actor", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "team_type" ] }, @@ -16736,21 +24811,31 @@ "description": "A user was demoted from a team maintainer to a team member.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" }, @@ -16759,19 +24844,31 @@ "description": "A team was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "team", "org_id", - "actor_id", - "actor", - "action", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "team", "operation_type", - "_document_id", - "programmatic_access_type", "team_type" ] }, @@ -16780,19 +24877,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "business_id", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", "actor_id", - "user", "business", - "action", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -16800,19 +24908,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org_id", + "@timestamp", + "_document_id", "action", - "operation_type", - "request_id", "actor", - "org", - "created_at", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", - "_document_id" + "operation_type", + "created_at" ] }, { @@ -16820,18 +24939,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", "@timestamp", - "action", "_document_id", - "user_agent", - "user_id", + "action", + "actor", + "actor_id", + "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "business", + "user_id", + "user_agent", "operation_type", - "actor", "created_at" ] }, @@ -16840,19 +24970,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "actor", - "action", - "operation_type", - "team", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "team" ] }, { @@ -16860,19 +25002,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", "@timestamp", - "actor_id", "_document_id", - "team", - "created_at", - "org_id", "action", - "request_id", - "user_agent", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "request_access_security_header" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "team", + "created_at" ] }, { @@ -16880,22 +25034,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "team", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", "business", "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "operation_type", + "created_at" ] }, { @@ -16903,22 +25066,31 @@ "description": "A user was promoted from a team member to a team maintainer.", "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "team", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "team", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" }, @@ -16927,20 +25099,30 @@ "description": "A team was removed from an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "team_type", "team", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -16951,22 +25133,31 @@ "description": "An organization member was removed from a team.", "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", "fields": [ - "request_id", - "operation_type", - "created_at", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "team", - "user_id", - "actor", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", + "user_id", "user_agent", - "_document_id", - "token_scopes", - "programmatic_access_type", + "operation_type", + "created_at", + "team", "team_type" ], "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" @@ -16976,43 +25167,64 @@ "description": "A repository was removed from a team's control.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "org_id", - "repo", - "repo_id", - "action", + "@timestamp", "_document_id", + "action", "actor", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "created_at", "team", - "org", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { "action": "team.rename", - "description": "A team's name was changed.", - "docs_reference_links": "N/A", - "fields": [ - "name", - "user_agent", - "created_at", - "team", - "operation_type", - "actor_id", - "org", + "description": "A team's name was changed.", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", "action", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "_document_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "created_at", + "team", + "operation_type", "team_type" ] }, @@ -17021,17 +25233,30 @@ "description": "Team synchronization with a tenant was disabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", "actor", - "request_id", - "org_id", "actor_id", - "operation_type", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", "org", - "user_agent" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -17040,19 +25265,30 @@ "description": "Team synchronization with a tenant was enabled.", "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", "fields": [ - "org_id", - "business_id", - "actor", - "created_at", - "user_agent", "@timestamp", - "operation_type", - "business", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" }, @@ -17061,19 +25297,30 @@ "description": "The Okta credentials for team synchronization with a tenant were changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -17081,28 +25328,37 @@ "description": "A team's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "team", - "org_id", "@timestamp", - "org", "_document_id", - "old_permission", - "request_id", - "repo", "action", - "repo_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "team", + "old_permission", "operation_type", "created_at", - "user_agent", "permission", "new_repo_permission", "new_repo_base_role", "old_repo_permission", - "old_repo_base_role", - "token_scopes", - "programmatic_access_type" + "old_repo_base_role" ] }, { @@ -17110,23 +25366,38 @@ "description": "Triggered when a user content edit is deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_content_id", "user_content_type", "created_at", - "user_agent", "deleted_by", "editor_id", - "_document_id", "deleted_at", - "action", - "actor_id", "editor", "deleted_by_id", "deleted_content", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -17134,16 +25405,30 @@ "description": "A Dependabot rule was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17153,16 +25438,30 @@ "description": "A Dependabot rule was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17172,18 +25471,31 @@ "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17193,21 +25505,33 @@ "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_id", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17215,21 +25539,32 @@ "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -17237,21 +25572,32 @@ "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "org", - "org_id", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -17259,16 +25605,30 @@ "description": "A Dependabot rule's conditions, actions, or metadata changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "vulnerability_alert_rule_id", "vulnerability_alert_rule_name", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17278,27 +25638,33 @@ "description": "A workflow job was approved.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", - "repo", - "repo_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -17307,23 +25673,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -17331,10 +25707,28 @@ "description": "A workflow run was cancelled.", "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17345,20 +25739,9 @@ "run_number", "cancelled_at", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Canceling a workflow run" }, @@ -17367,23 +25750,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -17393,10 +25784,28 @@ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17408,19 +25817,9 @@ "conclusion", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", - "programmatic_access_type", "actor_is_bot", "actor_is_agent" ], @@ -17431,10 +25830,28 @@ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17443,21 +25860,10 @@ "head_branch", "head_sha", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "public_repo", - "programmatic_access_type", "actor_is_bot", - "request_access_security_header", "actor_is_agent" ], "docs_reference_titles": "Understanding GitHub Actions" @@ -17467,23 +25873,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -17492,22 +25910,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -17515,21 +25944,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -17537,25 +25977,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -17563,23 +26011,36 @@ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", "fields": [ - "repo_id", - "repo", - "org_id", - "org", - "business_id", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "job_name", "runner_labels", "is_hosted_runner", "environment_name", "secrets_passed", - "action", - "_document_id", "operation_type", "created_at", - "@timestamp", "runner_owner_type", "job_workflow_ref", "calling_workflow_refs", @@ -17593,24 +26054,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -17619,10 +26089,28 @@ "description": "A workflow run was re-run.", "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "started_at", "event", @@ -17632,21 +26120,11 @@ "head_sha", "run_number", "workflow_id", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", - "_document_id", - "business", - "business_id", "trigger_id", "run_attempt", "rerun_type", "check_run_id", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "Re-running workflows and jobs" @@ -17656,25 +26134,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.20/user.json b/src/audit-logs/data/ghes-3.20/user.json index d3296f6f9bf4..554d93629caf 100644 --- a/src/audit-logs/data/ghes-3.20/user.json +++ b/src/audit-logs/data/ghes-3.20/user.json @@ -4,17 +4,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "org", "@timestamp", - "operation_type", - "user_agent", "_document_id", - "created_at", "action", - "request_id", "actor", "actor_id", - "org_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -22,18 +35,30 @@ "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_agent", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", "user", - "action", "user_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "How GitHub billing works" }, @@ -42,17 +67,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "request_id", "@timestamp", - "user_agent", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", - "user_id", + "token_scopes", "user", - "actor", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -61,18 +98,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", + "token_scopes", "user", - "request_id", - "_document_id", - "user_agent", - "actor", "user_id", - "actor_id", - "operation_type", - "@timestamp" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -80,18 +129,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", - "actor_id", - "operation_type", - "created_at", + "_document_id", + "action", "actor", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "token_id" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -99,29 +160,35 @@ "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "user_id", - "user", - "repo_id", - "repo", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -129,18 +196,30 @@ "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", - "operation_type", - "programmatic_access_type" + "operation_type" ] }, { @@ -148,21 +227,34 @@ "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", @@ -178,22 +270,34 @@ "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "uuid", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -201,25 +305,37 @@ "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", - "request_access_security_header", "old_target_amount", "old_budget_limit_type", "old_alert_enabled", @@ -233,17 +349,30 @@ "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ - "actor_id", - "user", "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "created_at", - "operation_type", - "_document_id", "user_agent", - "request_id" + "created_at", + "operation_type" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -252,19 +381,31 @@ "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "operation_type", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "@timestamp", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "_document_id", - "org", - "email", - "action", - "request_access_security_header" + "email" ], "docs_reference_titles": "Managing your payment and billing information" }, @@ -273,15 +414,28 @@ "description": "Azure subscription has been linked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -291,15 +445,28 @@ "description": "Azure subscription has been unlinked on this account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -309,18 +476,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", "@timestamp", - "actor_id", - "operation_type", "_document_id", - "request_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "created_at", - "action" + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -328,16 +508,28 @@ "description": "The premium request paid usage policy for your GitHub account was changed.", "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -349,18 +541,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", - "user_agent", - "created_at", "user_id", - "request_id", - "actor", - "action", - "@timestamp", - "_document_id", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -368,15 +572,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -386,26 +603,36 @@ "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -413,24 +640,34 @@ "description": "A CSV export was requested on the \"Coverage\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -438,26 +675,36 @@ "description": "A CSV export was requested on the \"Overview Dashboard\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", - "user", - "user_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -465,20 +712,31 @@ "description": "A CSV export was requested on the \"Risk\" page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -489,17 +747,29 @@ "description": "The cache retention policy for GitHub Actions was set for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type", "actor_is_bot" @@ -511,17 +781,29 @@ "description": "The cache storage policy for GitHub Actions was set for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", "operation_type", "actor_is_bot" @@ -533,17 +815,30 @@ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "created_at", "operation_type" ], @@ -554,20 +849,32 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "policy", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -576,19 +883,32 @@ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "limit", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -597,19 +917,31 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -618,20 +950,32 @@ "description": "The policy for fork pull request workflows was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "policy", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -640,19 +984,31 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, @@ -661,20 +1017,31 @@ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "visibility", - "user_agent", - "user", "@timestamp", - "repo", - "actor_id", - "user_id", + "_document_id", "action", - "created_at", "actor", - "operation_type", - "request_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, @@ -683,20 +1050,31 @@ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" @@ -707,17 +1085,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", - "created_at", - "_document_id", - "user_agent", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repo", - "programmatic_access_type" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -725,14 +1115,29 @@ "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "origin_repository", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -742,25 +1147,34 @@ "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", - "pull_request_id", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "org_id", + "user_agent", + "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -771,22 +1185,33 @@ "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" @@ -798,22 +1223,33 @@ "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repository_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "pull_request_id", "owner", "name", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Deleting a codespace" }, @@ -822,15 +1258,30 @@ "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "owner", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "public_repo" @@ -841,17 +1292,30 @@ "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -861,27 +1325,36 @@ "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", "org", - "owner", - "pull_request_id", - "machine_type", - "user_id", - "user", - "devcontainer_path", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "owner", + "pull_request_id", + "machine_type", + "devcontainer_path", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -889,19 +1362,32 @@ "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type" + "public_repo" ] }, { @@ -909,18 +1395,30 @@ "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -929,23 +1427,30 @@ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -953,16 +1458,30 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "_document_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "What is GitHub Copilot?" }, @@ -971,24 +1490,30 @@ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -996,15 +1521,28 @@ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1014,20 +1552,30 @@ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ] }, { @@ -1035,19 +1583,31 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "seat_assignment", - "request_access_security_header" + "seat_assignment" ] }, { @@ -1055,21 +1615,30 @@ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_id", - "user", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1077,22 +1646,33 @@ "description": "Specific repositories were disabled from using Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org_id", - "owner_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "owner", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -1100,21 +1680,31 @@ "description": "Specific repositories were enabled to use Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "owner_type", - "owner", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner_type", + "owner", "public_repo", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1124,20 +1714,32 @@ "description": "Copilot coding agent access was updated for the organization's or user's repositories.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_access", "old_access", - "org_id", "owner_type", "owner", - "org", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -1147,21 +1749,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1171,19 +1782,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -1193,21 +1813,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "runner_group_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1217,19 +1846,30 @@ "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1238,19 +1878,30 @@ "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, @@ -1259,19 +1910,30 @@ "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1280,19 +1942,30 @@ "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, @@ -1301,17 +1974,30 @@ "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1319,19 +2005,30 @@ "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1340,19 +2037,30 @@ "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1360,19 +2068,30 @@ "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1381,19 +2100,30 @@ "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -1401,19 +2131,30 @@ "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1422,19 +2163,30 @@ "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1442,19 +2194,30 @@ "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, @@ -1463,20 +2226,30 @@ "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "user", - "user_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -1484,22 +2257,31 @@ "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "operation_type", + "created_at" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1508,22 +2290,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "environment_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "environment_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1531,28 +2323,34 @@ "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "oauth_application_id", "key", "visibility", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1561,27 +2359,35 @@ "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Store information in variables" }, @@ -1590,25 +2396,33 @@ "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "token_scopes", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1617,26 +2431,33 @@ "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", "operation_type", - "@timestamp", "created_at", - "_document_id", - "business", - "business_id", - "public_repo", - "token_scopes", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1645,21 +2466,33 @@ "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1668,49 +2501,68 @@ "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "name", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", - "public_repo", - "request_access_security_header" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.update_actions_secret", - "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", - "fields": [ - "user_agent", - "request_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "operation_type", - "@timestamp", "created_at", + "public_repo" + ], + "docs_reference_titles": "Managing environments for deployment" + }, + { + "action": "environment.update_actions_secret", + "description": "A secret was updated for a GitHub Actions environment.", + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", "_document_id", - "public_repo", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "visibility", + "operation_type", + "created_at", + "public_repo" ], "docs_reference_titles": "Managing environments for deployment" }, @@ -1719,22 +2571,34 @@ "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "environment_name", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -1743,21 +2607,31 @@ "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_value", "approvers_was", "approvers", - "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], @@ -1768,21 +2642,32 @@ "description": "A gist was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "gist_id", - "@timestamp", "created_at", "operation_type", - "user_agent", - "actor", - "actor_id", - "visibility", - "action", - "_document_id", - "token_scopes", - "programmatic_access_type" + "visibility" ] }, { @@ -1790,20 +2675,32 @@ "description": "A gist was deleted.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "gist_id", - "visibility", - "created_at", + "@timestamp", "_document_id", - "user", - "request_id", - "operation_type", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "@timestamp", - "programmatic_access_type" + "gist_id", + "visibility", + "created_at", + "operation_type" ] }, { @@ -1811,21 +2708,32 @@ "description": "The visibility of a gist was updated.", "docs_reference_links": "N/A", "fields": [ - "action", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", "actor", - "user", - "gist_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "visibility", - "user_id", - "created_at", - "_document_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "operation_type", + "gist_id", + "visibility", + "created_at" ] }, { @@ -1833,22 +2741,33 @@ "description": "An SSH key was added to a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -1857,23 +2776,34 @@ "description": "An SSH key was removed from a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", - "user_id", "explanation", - "user", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, @@ -1882,23 +2812,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -1906,18 +2845,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -1928,20 +2877,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", - "runner_group_id", "business", - "user", - "user_id", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "runner_group_id", "created_at", "operation_type" ] @@ -1951,18 +2910,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "created_at", - "user_id", "@timestamp", - "user", - "operation_type", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -1970,18 +2941,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "created_at", - "_document_id", + "user_id", "user_agent", - "@timestamp", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -1989,25 +2972,35 @@ "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "name", "events", "active", "active_was", "hook_id", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -2015,25 +3008,34 @@ "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "operation_type", "@timestamp", "_document_id", + "action", "actor", - "name", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "user_agent", - "request_id", - "hook_id", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "name", + "hook_id", "created_at", "oauth_application_id", - "action", - "events", - "org_id", - "token_scopes", - "programmatic_access_type" + "events" ] }, { @@ -2041,26 +3043,35 @@ "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ - "oauth_application", + "@timestamp", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application", + "oauth_application_id", "hook_id", "events", - "repo", - "@timestamp", "operation_type", "name", - "action", - "created_at", - "org_id", - "org", - "token_scopes", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "About webhooks" }, @@ -2069,25 +3080,34 @@ "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "created_at", - "org", "name", - "request_id", - "actor_id", - "repo_id", - "org_id", - "action", "operation_type", "oauth_application_id", - "user_agent", - "hook_id", - "@timestamp", - "_document_id", - "token_scopes", - "programmatic_access_type" + "hook_id" ] }, { @@ -2095,26 +3115,35 @@ "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "events", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "events", "operation_type", - "action", - "_document_id", - "actor_id", "name", "events_were", - "@timestamp", "created_at", "hook_id", - "repo_id", - "org_id", - "org", - "user_agent", - "request_id", - "oauth_application_id", - "token_scopes", - "programmatic_access_type" + "oauth_application_id" ] }, { @@ -2122,21 +3151,32 @@ "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", "@timestamp", + "_document_id", + "action", "actor", - "user_agent", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", + "token_id", + "token_scopes", + "user", "user_id", - "_document_id", + "user_agent", + "operation_type", + "name", "integration", "created_at", - "programmatic_access_type", - "request_access_security_header", "application_client_id" ] }, @@ -2145,19 +3185,32 @@ "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "user_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "integration", - "user", - "_document_id", - "action", "operation_type", - "created_at", - "user_agent" + "created_at" ] }, { @@ -2165,21 +3218,32 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", "business", "business_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", + "integration", + "operation_type", + "created_at", "application_client_id" ] }, @@ -2188,19 +3252,33 @@ "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ - "operation_type", "@timestamp", - "name", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "repository_selection", + "token_id", + "token_scopes", + "user", "user_id", - "action", "user_agent", - "user", + "operation_type", + "name", + "repository_selection", "created_at", "integration", - "_document_id", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" @@ -2211,20 +3289,32 @@ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", - "request_id", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "_document_id", "repository_selection", "integration", - "user_id", - "user", - "action", "operation_type", "name", - "actor_id", - "user_agent", - "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" @@ -2234,24 +3324,35 @@ "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "repository_selection", "name", - "user", - "request_id", "integration", "operation_type", - "actor_id", - "action", "repositories_added", "created_at", - "_document_id", - "@timestamp", - "actor", - "user_agent", - "token_scopes", "repositories_added_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2262,23 +3363,35 @@ "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor", + "operation_type", "repository_selection", "repositories_removed", "integration", - "user_id", "created_at", - "_document_id", - "request_id", - "@timestamp", "name", - "action", - "actor_id", "repositories_removed_names", - "programmatic_access_type", "actor_is_bot", "application_client_id" ], @@ -2289,42 +3402,69 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ - "user_agent", - "request_id", - "name", - "repository_selection", - "actor_id", - "integration", - "user", - "user_id", - "action", - "operation_type", "@timestamp", - "created_at", "_document_id", - "request_access_security_header", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" - }, - { - "action": "integration_installation.unsuspend", - "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", - "fields": [ - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "repository_selection", - "actor_id", "integration", + "operation_type", + "created_at", + "application_client_id" + ], + "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + }, + { + "action": "integration_installation.unsuspend", + "description": "A GitHub App was unsuspended.", + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "repository_selection", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, @@ -2333,20 +3473,33 @@ "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ - "integration", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "integration", "name", - "user", "operation_type", - "actor_id", - "action", - "_document_id", - "request_id", "created_at", "repository_selection", - "@timestamp", - "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" @@ -2356,20 +3509,33 @@ "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ - "created_at", - "action", + "@timestamp", "_document_id", - "name", - "org_id", - "manager", - "operation_type", + "action", "actor", - "integration", - "org", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_agent" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "name", + "manager", + "operation_type", + "integration" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, @@ -2378,20 +3544,33 @@ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "integration", - "org_id", - "_document_id", - "action", - "actor", "name", "created_at", - "manager", - "@timestamp" + "manager" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, @@ -2400,20 +3579,32 @@ "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ] }, { @@ -2421,19 +3612,32 @@ "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2442,19 +3646,32 @@ "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "name", - "integration", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "name", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", "application_client_id" ] }, @@ -2463,19 +3680,32 @@ "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type", + "user_agent", + "name", + "integration", + "created_at", + "operation_type", "application_client_id" ], "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation" @@ -2486,21 +3716,34 @@ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "name", "transfer_to_id", - "user", "requester", - "action", "requester_id", - "actor_id", "created_at", - "_document_id", - "user_agent", "transfer_to", "operation_type", - "request_id", - "actor", "integration", "transfer_from", "transfer_from_id", @@ -2514,17 +3757,30 @@ "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "name", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "name", + "integration", "created_at", "operation_type", "application_client_id" @@ -2536,20 +3792,30 @@ "description": "An issue was marked as blocked by another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -2560,19 +3826,30 @@ "description": "The blocked by relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2582,20 +3859,30 @@ "description": "An issue was marked as blocking another issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -2606,20 +3893,30 @@ "description": "The blocking relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -2630,18 +3927,30 @@ "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "actor_id", "@timestamp", "_document_id", - "user_agent", - "operation_type", - "created_at", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -2649,21 +3958,34 @@ "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "secondary_category", - "actor", - "primary_category", - "user", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", + "secondary_category", + "primary_category", "operation_type", "created_at", - "request_id", - "actor_id", "marketplace_listing", - "integration", - "action" + "integration" ] }, { @@ -2671,21 +3993,34 @@ "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ - "primary_category", - "user_agent", - "request_id", - "actor", - "marketplace_listing", "@timestamp", - "integration", - "org_id", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "primary_category", + "marketplace_listing", + "integration", "secondary_category", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -2693,22 +4028,35 @@ "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ - "primary_category", + "@timestamp", "_document_id", - "user", - "created_at", - "user_agent", - "oauth_application", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "marketplace_listing", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "primary_category", + "created_at", + "oauth_application", + "marketplace_listing", "secondary_category", "oauth_application_id", - "actor", - "actor_id", - "operation_type", - "@timestamp" + "operation_type" ] }, { @@ -2716,19 +4064,32 @@ "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "org", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "secondary_category", "operation_type", "marketplace_listing", - "action", - "@timestamp", - "_document_id", "primary_category", "integration" ] @@ -2739,21 +4100,36 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "actor", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type", "marketplace_listing", "has_free_trial", - "user_agent", - "request_id", - "actor_id", "yearly_price_in_cents", "description", "bullets", "monthly_price_in_cents", - "marketplace_listing_plan", - "_document_id" + "marketplace_listing_plan" ] }, { @@ -2761,22 +4137,37 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "marketplace_listing_plan", "marketplace_listing", "description", "bullets", "has_free_trial", "created_at", - "actor_id", "operation_type", - "_document_id", - "action", - "user_agent", - "request_id", - "actor", "monthly_price_in_cents", - "yearly_price_in_cents", - "@timestamp" + "yearly_price_in_cents" ] }, { @@ -2784,21 +4175,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor", - "marketplace_listing_plan", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "marketplace_listing_plan", "description", "yearly_price_in_cents", - "@timestamp", "created_at", - "actor_id", "bullets", "has_free_trial", "marketplace_listing", - "user_agent", "monthly_price_in_cents", - "action", "operation_type" ] }, @@ -2807,21 +4213,36 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "monthly_price_in_cents", - "marketplace_listing", + "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "monthly_price_in_cents", + "marketplace_listing", "description", "bullets", "yearly_price_in_cents", - "request_id", - "actor_id", "has_free_trial", "marketplace_listing_plan", - "user_agent", - "@timestamp", "operation_type", - "actor", "created_at" ] }, @@ -2830,22 +4251,35 @@ "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "secondary_category", - "oauth_application_id", "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "secondary_category", + "oauth_application_id", "operation_type", "oauth_application", - "actor", "created_at", "marketplace_listing", - "request_id", - "actor_id", - "primary_category", - "user" + "primary_category" ] }, { @@ -2853,22 +4287,35 @@ "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", - "user", - "user_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -2876,19 +4323,31 @@ "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -2896,21 +4355,30 @@ "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", "token_id", "token_scopes", - "repo_id", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2920,16 +4388,29 @@ "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2939,18 +4420,31 @@ "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "max_entries_to_build", "min_entries_to_merge", - "repo_id", "public_repo", - "repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -2960,14 +4454,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", "@timestamp", "_document_id", - "user_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -2975,19 +4485,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id" + "created_at" ] }, { @@ -2995,18 +4516,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "created_at", - "operation_type", "org_id", - "@timestamp", - "_document_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3014,23 +4547,31 @@ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ - "repo", - "org_id", + "@timestamp", "_document_id", - "org", - "repo_id", "action", "actor", - "created_at", - "operation_type", - "@timestamp", - "user_agent", - "request_id", "actor_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "actor_is_bot" ] }, { @@ -3038,20 +4579,30 @@ "description": "An OAuth access token was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", "fields": [ - "_document_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "user", - "user_id", - "created_at", + "_document_id", "action", + "actor", "actor_id", - "request_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" @@ -3062,19 +4613,30 @@ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", "fields": [ "@timestamp", - "user_agent", - "action", - "operation_type", "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_id", + "user_agent", + "operation_type", + "created_at", "explanation", - "hashed_token", - "actor_id", - "token_scopes", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" @@ -3084,37 +4646,60 @@ "description": "An OAuth access token was regenerated.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "_document_id", - "created_at", "@timestamp", - "operation_type", + "_document_id", "action", - "user_agent", - "request_id", "actor", "actor_id", - "token_scopes", - "programmatic_access_type", - "oauth_application_name" - ] - }, - { - "action": "oauth_access.revoke", - "description": "An OAuth access token was revoked.", - "docs_reference_links": "N/A", - "fields": [ - "request_id", - "request_access_security_header", + "business", + "business_id", "hashed_token", - "token_id", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", "user", "user_id", - "action", - "_document_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_name" + ] + }, + { + "action": "oauth_access.revoke", + "description": "An OAuth access token was revoked.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -3124,18 +4709,30 @@ "description": "An OAuth access token was updated.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", - "created_at", "action", - "@timestamp", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -3143,20 +4740,32 @@ "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", "operation_type", - "user_agent", - "actor_id", - "org_id", - "action", - "actor", - "oauth_application", - "@timestamp", - "_document_id", - "request_id", - "request_access_security_header" + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3165,20 +4774,32 @@ "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "created_at", - "oauth_application_id", - "user_id", - "operation_type", "@timestamp", - "user_agent", - "oauth_application", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "created_at", + "oauth_application_id", + "operation_type", + "oauth_application" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3187,20 +4808,32 @@ "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3209,20 +4842,32 @@ "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3231,19 +4876,32 @@ "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "oauth_application", "operation_type", - "request_id", - "actor_id", - "_document_id", "created_at", - "actor", - "oauth_application_id", - "@timestamp", - "user_agent" + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3252,20 +4910,32 @@ "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application", - "oauth_application_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "oauth_application", + "oauth_application_id", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3274,41 +4944,66 @@ "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "oauth_application_id", - "oauth_application", - "actor_id", - "user_agent", "@timestamp", - "request_id", - "user_id", - "action", "_document_id", + "action", "actor", - "user", - "created_at", - "operation_type", - "request_access_security_header" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "oauth_application", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + }, + { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "oauth_application", - "actor_id", - "oauth_application_id", "@timestamp", - "user_id", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "operation_type", + "created_at", + "oauth_application", + "oauth_application_id" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, @@ -3317,24 +5012,31 @@ "description": "An authorization for an OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ - "operation_type", - "user_agent", - "user_id", - "actor", - "org_id", + "@timestamp", "_document_id", - "request_id", "action", - "@timestamp", - "created_at", + "actor", "actor_id", - "user", "business", "business_id", - "token_scopes", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "actor_is_bot", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_is_bot", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -3344,20 +5046,31 @@ "description": "An authorization for an OAuth application was deleted.", "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", "fields": [ - "user_agent", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "actor", "created_at", "explanation", - "user", - "user_id", - "org_id", - "action", - "actor_id", - "token_scopes", "actor_is_bot", "oauth_application_name" ], @@ -3368,20 +5081,31 @@ "description": "An authorization for an OAuth application was updated.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", - "actor_id", "user_agent", - "@timestamp", "operation_type", - "action", - "user", "created_at", - "_document_id", "actor_is_bot", - "request_access_security_header", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" @@ -3391,21 +5115,31 @@ "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ - "permission", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "operation_type", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", - "user_agent", - "org_id", "user_id", - "actor_id", - "action", - "programmatic_access_type", + "user_agent", + "permission", + "operation_type", + "created_at", "actor_is_bot" ] }, @@ -3414,24 +5148,34 @@ "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "inviter", "public_repo", "permission", "invitee", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3439,20 +5183,30 @@ "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "business", - "business_id", - "token_scopes" + "created_at" ] }, { @@ -3460,22 +5214,30 @@ "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -3483,20 +5245,30 @@ "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "business", "business_id", - "token_scopes" + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -3504,22 +5276,30 @@ "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", - "org", - "org_id", "business", "business_id", - "action", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "token_scopes" + "created_at" ] }, { @@ -3527,21 +5307,30 @@ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", - "request_id", - "actor_id", - "user_agent", - "actor", "action", - "user_id", - "@timestamp", - "created_at", - "user", - "operation_type", - "org_id", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -3549,26 +5338,35 @@ "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "actor_is_bot" ] }, @@ -3577,26 +5375,34 @@ "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3604,28 +5410,36 @@ "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", "start_date", "end_date", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3633,26 +5447,34 @@ "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "query", "filename", "requested_at", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -3660,18 +5482,28 @@ "description": "The cache retention policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -3683,18 +5515,28 @@ "description": "The cache storage policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "org", - "org_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type", "actor_is_bot" @@ -3706,20 +5548,31 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, @@ -3728,16 +5581,29 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "created_at", "operation_type" ], @@ -3748,18 +5614,31 @@ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "limit", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, @@ -3768,18 +5647,30 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, @@ -3788,18 +5679,31 @@ "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "policy", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, @@ -3808,18 +5712,30 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -3829,20 +5745,31 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "org_id", - "created_at", "_document_id", - "user", - "user_id", "action", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "old_permission", "permission", - "actor", - "user_agent", - "operation_type", - "org" + "operation_type" ] }, { @@ -3850,17 +5777,30 @@ "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "action", "@timestamp", - "request_id", + "_document_id", + "action", + "actor", "actor_id", - "permission", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", "org", "org_id", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", "visibility", "operation_type" ] @@ -3870,20 +5810,31 @@ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ - "actor_id", - "permission", + "@timestamp", + "_document_id", "action", - "org_id", "actor", - "created_at", - "_document_id", + "actor_id", + "business", "business_id", - "operation_type", + "hashed_token", "org", - "user_agent", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "business", - "@timestamp" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "permission", + "created_at", + "operation_type" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, @@ -3892,20 +5843,34 @@ "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -3914,41 +5879,70 @@ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "owner", - "owner_type", - "domain", - "state", - "action", - "_document_id", - "@timestamp", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "owner", + "owner_type", + "domain", + "state", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "owner", "owner_type", "domain", "state", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, @@ -3957,19 +5951,31 @@ "description": "A new passkey was added.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3977,19 +5983,31 @@ "description": "A new passkey was removed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "nickname", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "nickname", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -3997,18 +6015,30 @@ "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "user", - "operation_type", - "user_id", + "@timestamp", "_document_id", "action", "actor", "actor_id", - "@timestamp", - "created_at", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4016,16 +6046,30 @@ "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "actor_id", "@timestamp", - "user_id", + "_document_id", "action", - "operation_type", "actor", - "_document_id", - "request_access_security_header" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -4033,18 +6077,30 @@ "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "request_id", - "org_id", - "created_at", - "actor_id", "@timestamp", + "_document_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -4052,18 +6108,31 @@ "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4074,18 +6143,31 @@ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4096,17 +6178,30 @@ "description": "Triggered when you create a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repository_selection", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", + "repository_selection", "created_at", "operation_type" ] @@ -4116,19 +6211,31 @@ "description": "Triggered when you regenerate a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4136,12 +6243,29 @@ "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", "fields": [ - "user_programmatic_access_name", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "user_programmatic_access_name", "created_at", "operation_type" ], @@ -4152,20 +6276,32 @@ "description": "Triggered when you delete a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "explanation", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4173,17 +6309,30 @@ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -4194,18 +6343,31 @@ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_id", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -4217,17 +6379,30 @@ "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" @@ -4239,17 +6414,30 @@ "description": "A fine-grained personal access token was updated.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_programmatic_access_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "user_programmatic_access_name", "repository_selection", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4260,15 +6448,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "runner_group_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -4278,17 +6481,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user", - "user_id", "business", "business_id", - "action", - "_document_id", - "@timestamp", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4298,35 +6512,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "actor", - "actor_id", - "name", - "runner_group_id", - "action", - "_document_id", "@timestamp", - "created_at", - "operation_type" - ] - }, - { - "action": "private_vulnerability_reporting.disable", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "name", + "runner_group_id", + "created_at", + "operation_type" + ] + }, + { + "action": "private_vulnerability_reporting.disable", + "description": "N/A", + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -4336,17 +6576,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4356,17 +6607,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4376,17 +6638,28 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -4396,17 +6669,30 @@ "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ - "user", - "actor_id", - "user_id", "@timestamp", - "created_at", - "owner", - "action", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", + "created_at", + "owner", "operation_type" ], "docs_reference_titles": "Personalize your profile" @@ -4416,17 +6702,30 @@ "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", + "action", "actor", - "user_agent", - "operation_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "created_at", "user_id", - "action", - "request_id", - "_document_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4434,20 +6733,31 @@ "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ - "org_id", - "user_agent", - "request_id", - "operation_type", "@timestamp", - "created_at", - "repo_id", - "org", "_document_id", - "project_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "project_id", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" @@ -4457,25 +6767,37 @@ "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "collaborator_type", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", - "old_project_role", - "request_access_security_header" + "old_project_role" ] }, { @@ -4483,20 +6805,32 @@ "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "collaborator_type", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", + "collaborator_type", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4504,25 +6838,37 @@ "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", - "user", - "user_id", "collaborator", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -4530,17 +6876,30 @@ "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user", + "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "@timestamp", - "actor_id", - "action", - "created_at", - "actor" + "operation_type", + "created_at" ] }, { @@ -4548,17 +6907,30 @@ "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", "action", - "actor_id", - "operation_type", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "created_at", - "_document_id", "user_agent", - "user" + "operation_type", + "created_at" ] }, { @@ -4566,18 +6938,30 @@ "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, @@ -4586,18 +6970,30 @@ "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, @@ -4606,19 +7002,30 @@ "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ - "repo_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", "org_id", - "user_agent", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", - "created_at", - "org", - "repo" + "created_at" ] }, { @@ -4626,17 +7033,30 @@ "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "project_id", - "_document_id", "user_agent", + "project_id", "operation_type", - "user", - "@timestamp", "created_at", "project_kind", "project_name" @@ -4648,22 +7068,31 @@ "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ - "action", - "created_at", - "request_id", - "actor_id", - "old_name", - "operation_type", "@timestamp", - "repo", "_document_id", - "user_agent", - "org_id", - "business_id", + "action", "actor", - "repo_id", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "business" + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "old_name", + "operation_type" ] }, { @@ -4671,19 +7100,30 @@ "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ - "repo", - "repo_id", - "operation_type", - "actor", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "org", - "org_id" + "operation_type", + "created_at" ] }, { @@ -4691,36 +7131,62 @@ "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ - "actor", - "org", "@timestamp", "_document_id", - "operation_type", - "created_at", - "request_id", - "actor_id", "action", - "org_id", - "user_agent" - ] - }, - { - "action": "project.update_team_permission", - "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A", - "fields": [ - "created_at", - "org_id", - "operation_type", - "org", + "actor", "actor_id", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "team", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "project.update_team_permission", + "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "created_at", + "operation_type", + "team" ] }, { @@ -4728,20 +7194,30 @@ "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user_id", - "operation_type", "@timestamp", - "actor_id", - "user", - "user_agent", + "_document_id", + "action", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", - "_document_id", "org_id", - "action", - "programmatic_access_type" + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -4749,18 +7225,30 @@ "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -4769,18 +7257,30 @@ "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, @@ -4789,16 +7289,29 @@ "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", @@ -4810,21 +7323,33 @@ "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "project_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "project_id", "created_at", "operation_type", "project_kind", - "project_name", - "request_access_security_header" + "project_name" ] }, { @@ -4832,18 +7357,31 @@ "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "name", "merge_queue_enforcement_level", - "repo", - "repo_id", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -4854,23 +7392,34 @@ "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ - "read_only", - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "read_only", "operation_type", "created_at", - "_document_id", "key", "fingerprint", - "actor", - "action", - "user", - "user_id", - "@timestamp", - "request_id", - "title", - "token_scopes", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, @@ -4879,24 +7428,35 @@ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ - "fingerprint", - "user_agent", - "read_only", - "explanation", - "repo", "@timestamp", - "action", - "key", - "operation_type", "_document_id", + "action", "actor", - "title", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "created_at", - "token_scopes", - "programmatic_access_type" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "fingerprint", + "read_only", + "explanation", + "key", + "operation_type", + "title", + "created_at" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, @@ -4905,20 +7465,34 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "title", "key", "fingerprint", "read_only", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "token_scopes" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4927,21 +7501,34 @@ "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "created_at", - "operation_type", + "@timestamp", "_document_id", - "title", - "request_id", - "key", "action", "actor", - "read_only", - "explanation", - "repo_id", - "@timestamp", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "created_at", + "operation_type", + "title", + "key", + "read_only", + "explanation", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" @@ -4951,22 +7538,34 @@ "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "key", "fingerprint", "read_only", - "repo_id", "operation_type", "created_at", - "actor_id", - "repo", - "action", - "_document_id", - "request_id", - "title", - "@timestamp", - "programmatic_access_type" + "title" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -4975,25 +7574,35 @@ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "repo_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "fingerprint", - "@timestamp", - "request_id", - "actor_id", "oauth_application_id", "title", - "action", - "user_agent", "created_at", - "repo", "read_only", - "operation_type", - "_document_id", - "user", - "user_id", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -5002,23 +7611,34 @@ "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ - "operation_type", - "user", "@timestamp", "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", "key", "fingerprint", - "actor_id", - "actor", "title", - "user_agent", - "user_id", - "request_id", - "read_only", - "token_scopes", - "programmatic_access_type" + "read_only" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, @@ -5027,22 +7647,32 @@ "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ - "repo_id", - "user", - "request_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "created_at", "user_agent", - "actor", - "action", - "repo", + "operation_type", + "created_at", "visibility", - "_document_id", - "previous_visibility", - "programmatic_access_type" + "previous_visibility" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, @@ -5051,21 +7681,30 @@ "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "created_at", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, @@ -5074,25 +7713,32 @@ "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ - "visibility", - "repo", - "created_at", - "user_agent", - "operation_type", "@timestamp", "_document_id", + "action", "actor", "actor_id", - "repo_id", - "user", - "request_id", - "action", - "user_id", - "oauth_application_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "visibility", + "created_at", + "operation_type", + "oauth_application_id" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, @@ -5101,23 +7747,31 @@ "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ + "@timestamp", + "_document_id", "action", - "user_agent", "actor", - "repo", - "repo_id", - "user", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "topic", - "@timestamp", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "topic", "created_at", - "operation_type", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, @@ -5126,24 +7780,31 @@ "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, @@ -5152,23 +7813,31 @@ "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "business", - "business_id", - "action", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" @@ -5178,22 +7847,31 @@ "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ - "repo_id", - "user_agent", - "user_id", - "created_at", "@timestamp", - "repo", - "user", - "operation_type", - "visibility", + "_document_id", "action", - "actor_id", "actor", - "_document_id", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -5202,19 +7880,32 @@ "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", - "oauth_application_id", - "user_agent", - "request_id", - "created_at", "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type", - "action", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -5223,24 +7914,34 @@ "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", "tool", - "category", - "request_access_security_header" + "category" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, @@ -5249,23 +7950,32 @@ "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "tool", "branch", "category", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -5276,17 +7986,30 @@ "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "repo", - "operation_type", - "@timestamp", - "request_id" + "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -5295,15 +8018,28 @@ "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "repo", "@timestamp", - "request_id", - "actor", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -5314,36 +8050,62 @@ "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "request_id", - "repo_id", - "action", - "user_agent", - "_document_id", "@timestamp", - "created_at", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "oauth_application_id", - "created_at", - "action", - "request_id", - "repo_id", - "repo", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" @@ -5353,19 +8115,30 @@ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "user_agent", - "request_id", - "operation_type", - "created_at", - "actor", - "org", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "org_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -5374,17 +8147,30 @@ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ - "actor", - "operation_type", - "created_at", - "user_agent", - "request_id", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "@timestamp", - "_document_id" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, @@ -5393,26 +8179,32 @@ "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ - "user_agent", - "request_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "token_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, @@ -5421,30 +8213,35 @@ "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "user_id", - "visibility", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "action", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", "request_category", - "@timestamp", "created_at", - "_document_id", - "actor", - "user_agent", - "org", "oauth_application_id", - "org_id", "request_method", - "business", - "business_id", "public_repo", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" @@ -5454,20 +8251,31 @@ "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5476,25 +8284,33 @@ "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5503,23 +8319,34 @@ "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -5527,25 +8354,34 @@ "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ - "repo", + "@timestamp", "_document_id", - "user_agent", - "user_id", - "actor", "action", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "request_category", - "actor_id", "visibility", - "request_id", "created_at", - "@timestamp", "request_method", "oauth_application_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" @@ -5555,23 +8391,33 @@ "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ - "actor", "@timestamp", - "visibility", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "user", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor_id", - "cname", - "user_agent", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "visibility", + "cname", "created_at", - "_document_id", - "action", "operation_type", - "old_cname", - "programmatic_access_type" + "old_cname" ] }, { @@ -5579,21 +8425,31 @@ "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", "user_id", - "visibility", - "action", "user_agent", + "visibility", "operation_type", - "repo_id", - "created_at", - "@timestamp", - "request_id", - "actor", - "repo", - "programmatic_access_type" + "created_at" ] }, { @@ -5601,21 +8457,31 @@ "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ - "created_at", - "user_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", - "repo", + "user_id", "user_agent", - "_document_id", - "actor_id", - "@timestamp", - "actor", + "created_at", "visibility", - "operation_type", - "repo_id", - "programmatic_access_type" + "operation_type" ] }, { @@ -5623,22 +8489,31 @@ "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "_document_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", "visibility", - "user_id", - "request_id", - "repo", - "@timestamp", "operation_type", - "action", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -5646,21 +8521,31 @@ "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "user_id", - "created_at", - "visibility", + "_document_id", + "action", "actor", "actor_id", - "user", - "operation_type", - "repo_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "_document_id", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "visibility", + "operation_type" ] }, { @@ -5668,20 +8553,31 @@ "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -5689,64 +8585,97 @@ "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "programmatic_access_type", - "request_access_security_header" - ] - }, - { - "action": "repo.pages_soft_delete", - "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", - "docs_reference_links": "N/A", - "fields": [ - "visibility", "repo", "repo_id", - "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", - "created_at", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "request_access_security_header" + "created_at" ] }, { - "action": "repo.pages_soft_delete_restore", - "description": "A GitHub Pages site that was previously soft-deleted was restored.", + "action": "repo.pages_soft_delete", + "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", - "repo", - "repo_id", - "public_repo", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "public_repo", + "created_at", + "operation_type" + ] + }, + { + "action": "repo.pages_soft_delete_restore", + "description": "A GitHub Pages site that was previously soft-deleted was restored.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -5754,21 +8683,31 @@ "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor_id", - "operation_type", - "user_agent", - "actor", "@timestamp", - "repo_id", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "visibility", - "repo", - "created_at", - "action", - "programmatic_access_type" + "created_at" ] }, { @@ -5776,18 +8715,30 @@ "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ - "actor_id", - "repo", - "operation_type", - "action", "@timestamp", - "actor", - "user_agent", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "request_access_security_header" + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Adding self-hosted runners" }, @@ -5796,22 +8747,31 @@ "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -5820,24 +8780,32 @@ "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "key", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -5846,23 +8814,33 @@ "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "key", - "integration", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "key", + "integration", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -5870,26 +8848,31 @@ "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ - "request_id", - "user", - "business", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "actor", - "created_at", + "programmatic_access_type", + "repo", "repo_id", - "user_agent", - "business_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "created_at", "operation_type", - "@timestamp", - "_document_id", - "visibility", - "repo", - "token_scopes", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, @@ -5898,22 +8881,31 @@ "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ - "request_id", - "actor_id", - "repo_id", "@timestamp", "_document_id", - "repo", - "org_id", "action", - "operation_type", - "user_agent", "actor", - "created_at", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" - ], + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ], "docs_reference_titles": "Removing self-hosted runners" }, { @@ -5921,25 +8913,31 @@ "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ - "user", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "topic", "operation_type", - "user_id", - "org", - "org_id", - "actor", - "business", - "request_id", - "repo", - "@timestamp", - "created_at", - "_document_id", - "actor_id", - "business_id", - "programmatic_access_type" + "created_at" ] }, { @@ -5947,22 +8945,32 @@ "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", + "action", "actor", - "old_name", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", + "old_name", "created_at", - "user", - "action", "operation_type", - "visibility", - "repo_id", - "_document_id", - "programmatic_access_type" + "visibility" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, @@ -5971,19 +8979,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "repo", - "action", + "@timestamp", "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "request_id", - "repo_id", - "@timestamp", - "created_at", - "actor", - "user_id" + "operation_type", + "created_at" ] }, { @@ -5991,22 +9010,30 @@ "description": "The cache retention policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -6018,22 +9045,30 @@ "description": "The cache storage policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "request_access_security_header", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "public_repo", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "actor_is_bot" @@ -6045,23 +9080,32 @@ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", - "_document_id", - "@timestamp", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "policy", "created_at", "operation_type", - "business", - "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" @@ -6071,20 +9115,31 @@ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ], @@ -6095,21 +9150,32 @@ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "limit", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "limit", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, @@ -6118,22 +9184,32 @@ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, @@ -6142,21 +9218,32 @@ "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "policy", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", + "policy", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, @@ -6165,22 +9252,32 @@ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "public_repo", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "visibility", + "public_repo", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, @@ -6191,16 +9288,27 @@ "fields": [ "@timestamp", "_document_id", - "user_agent", - "actor_id", - "created_at", - "actor", - "repo_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "request_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", "operation_type" ] }, @@ -6209,22 +9317,31 @@ "description": "Temporary access was enabled for a repository.", "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "repo", - "repo_id", + "user_agent", "public_repo", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ], "docs_reference_titles": "Accessing user-owned repositories in your enterprise" }, @@ -6234,22 +9351,33 @@ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", - "user_id", "_document_id", - "request_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", - "owner", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "owner", "old_user", - "action", "operation_type", "created_at", - "user_agent", - "repo", "visibility", - "repo_was", - "actor" + "repo_was" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, @@ -6258,23 +9386,33 @@ "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "new_nwo", "visibility", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "public_repo", - "request_access_security_header" + "public_repo" ] }, { @@ -6284,19 +9422,29 @@ "fields": [ "@timestamp", "_document_id", - "operation_type", - "user_id", - "request_id", - "user", "action", - "user_agent", - "created_at", "actor", - "visibility", - "repo_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "request_access_security_header" + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at", + "visibility" ] }, { @@ -6304,21 +9452,31 @@ "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", - "request_id", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "operation_type", - "created_at", - "_document_id", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "visibility", - "user_agent", "user_id", - "action", - "programmatic_access_type" + "user_agent", + "operation_type", + "created_at", + "visibility" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, @@ -6327,24 +9485,33 @@ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "visibility", "policy", "old_policy", - "repo", - "repo_id", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id" + "operation_type" ] }, { @@ -6352,25 +9519,32 @@ "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "oauth_application_id", - "key", - "repo", - "repo_id", - "org", - "org_id", - "action", - "operation_type", - "@timestamp", - "created_at", - "_document_id", "business", "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "oauth_application_id", + "key", + "operation_type", + "created_at" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, @@ -6379,24 +9553,34 @@ "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", - "repo", - "repo_id", + "business", + "business_id", + "hashed_token", "org", "org_id", - "action", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", "new_policy", "old_policy", "updated_access_policy", - "programmatic_access_type", "actor_is_bot" ] }, @@ -6405,25 +9589,33 @@ "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "business", - "business_id", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Store information in variables" }, @@ -6432,22 +9624,31 @@ "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "visibility", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", + "visibility", "operation_type", - "@timestamp", "created_at", - "_document_id", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -6456,26 +9657,34 @@ "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "repo", - "repo_id", - "org", - "org_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -6483,31 +9692,38 @@ "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "oauth_application_id", - "user", - "@timestamp", - "repo", "operation_type", - "request_id", - "org_id", - "actor_id", "visibility", "old_permission", - "org", - "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", - "token_scopes", - "programmatic_access_type", "actor_is_bot" ] }, @@ -6516,21 +9732,31 @@ "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "operation_type", - "created_at", - "actor_id", - "repo_id", + "@timestamp", + "_document_id", "action", - "request_id", "actor", - "content_type", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", - "_document_id", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at", + "content_type" ] }, { @@ -6538,21 +9764,31 @@ "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ - "content_type", - "created_at", - "actor_id", - "user_id", - "operation_type", - "request_id", + "@timestamp", "_document_id", + "action", "actor", - "repo_id", - "user_agent", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action", - "@timestamp", - "request_access_security_header" + "user_id", + "user_agent", + "content_type", + "created_at", + "operation_type" ] }, { @@ -6560,21 +9796,32 @@ "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "created_at", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "invitee", - "operation_type", - "actor", "repo_id", - "_document_id", - "action", - "user_agent", - "inviter", - "@timestamp", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "invitee", + "operation_type", + "inviter" ] }, { @@ -6582,20 +9829,32 @@ "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ - "inviter", - "action", - "operation_type", + "@timestamp", "_document_id", - "repo_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "@timestamp", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "inviter", + "operation_type", "invitee", - "created_at", - "request_id", - "actor", - "actor_id", - "request_access_security_header" + "created_at" ] }, { @@ -6603,21 +9862,32 @@ "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp", - "invitee", - "action", - "request_id", - "inviter", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", - "created_at", - "user_agent", "repo_id", - "operation_type", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "invitee", + "inviter", + "created_at", + "operation_type" ] }, { @@ -6625,19 +9895,32 @@ "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ - "repo", + "@timestamp", "_document_id", - "actor", - "invitee", "action", - "@timestamp", - "request_id", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "invitee", "operation_type", "created_at", - "inviter", - "user_agent", - "repo_id" + "inviter" ] }, { @@ -6645,31 +9928,39 @@ "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, @@ -6678,19 +9969,30 @@ "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", "ruleset_id", @@ -6698,8 +10000,7 @@ "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", - "ruleset_bypass_actors", - "request_access_security_header" + "ruleset_bypass_actors" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, @@ -6708,23 +10009,32 @@ "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "old_name", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "old_name", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "business", - "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", @@ -6749,18 +10059,30 @@ "description": "A security key was registered for an account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "created_at", - "user_id", - "action", - "operation_type", - "request_id", "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -6768,18 +10090,30 @@ "description": "A security key was removed from an account.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "operation_type", - "_document_id", - "user_agent", "@timestamp", - "request_id", - "actor_id", + "_document_id", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -6787,31 +10121,59 @@ "description": "A user linked a social identity to their account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "request_access_security_header", - "user_id", - "action", - "actor_id", - "_document_id", "@timestamp", - "created_at", - "operation_type" - ] - }, - { - "action": "social_identity.unlinked", - "description": "A user unlinked a social identity from their account.", - "docs_reference_links": "N/A", - "fields": [ + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", - "action", - "_document_id", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ] + }, + { + "action": "social_identity.unlinked", + "description": "A user unlinked a social identity from their account.", + "docs_reference_links": "N/A", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", "operation_type" ] @@ -6821,15 +10183,28 @@ "description": "A user unlinked all social identities from their account.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type" ] @@ -6839,16 +10214,29 @@ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6858,18 +10246,31 @@ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, @@ -6878,16 +10279,29 @@ "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", "org", "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -6898,15 +10312,28 @@ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", - "action", - "created_at", "_document_id", - "request_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", "repository", "repository_id", - "actor", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor_id", + "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" @@ -6916,15 +10343,30 @@ "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "operation_type", + "@timestamp", "_document_id", - "created_at", - "actor", - "user", "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Downgrading a sponsorship" }, @@ -6933,17 +10375,30 @@ "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "actor", - "user_id", - "action", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -6952,17 +10407,31 @@ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ - "active", - "user", - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", - "_document_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "active", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, @@ -6971,33 +10440,61 @@ "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ - "actor_id", - "action", "@timestamp", - "request_id", - "user_id", - "created_at", - "user", "_document_id", - "user_agent", + "action", "actor", - "operation_type" - ], - "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" + ], + "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ - "user_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" @@ -7007,17 +10504,30 @@ "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "request_id", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "actor_id", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -7026,17 +10536,30 @@ "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_id", - "operation_type", - "request_id", - "actor_id", "@timestamp", "_document_id", - "user", "action", - "created_at", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor" + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -7045,18 +10568,31 @@ "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7065,15 +10601,29 @@ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "operation_type", - "created_at", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "actor", - "action", - "_document_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, @@ -7083,16 +10633,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", - "request_id", - "user", - "action", - "user_agent", - "operation_type", "_document_id", + "action", "actor", "actor_id", - "user_id" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7100,15 +10663,28 @@ "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "user_agent", - "user", "@timestamp", - "actor_id", - "user_id", - "request_id", "_document_id", - "actor", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", "created_at" ], @@ -7119,16 +10695,29 @@ "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ - "operation_type", - "request_id", - "actor", - "user_id", - "action", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", + "user_agent", + "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" @@ -7138,17 +10727,30 @@ "description": "Triggered when you send an email update to your sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", "fields": [ - "request_id", - "actor", - "action", - "user_agent", - "operation_type", + "@timestamp", "_document_id", - "created_at", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" }, @@ -7157,17 +10759,30 @@ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "patreon_email", - "patreon_username", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -7178,17 +10793,30 @@ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "patreon_email", - "patreon_username", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "patreon_email", + "patreon_username", "created_at", "operation_type" ], @@ -7199,18 +10827,29 @@ "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "repo", - "repo_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -7220,16 +10859,29 @@ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -7239,17 +10891,30 @@ "description": "You join the waitlist to join GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", "user_agent", - "actor_id", - "action", "operation_type", - "created_at", - "user", - "@timestamp", - "_document_id" + "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, @@ -7258,16 +10923,29 @@ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "sponsors_listing_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -7277,23 +10955,33 @@ "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7301,23 +10989,33 @@ "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7325,23 +11023,33 @@ "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7349,23 +11057,33 @@ "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", - "title", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "title", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -7373,15 +11091,30 @@ "description": "Triggered when you accept a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7390,15 +11123,30 @@ "description": "Triggered when you cancel a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7407,15 +11155,30 @@ "description": "Triggered when you create a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7424,15 +11187,30 @@ "description": "Triggered when you decline a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7441,15 +11219,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7457,15 +11250,30 @@ "description": "Triggered when you revoke a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "action", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, @@ -7474,17 +11282,30 @@ "description": "A new trusted device was added.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7492,17 +11313,30 @@ "description": "A trusted device was removed.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -7510,14 +11344,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "action", - "request_id", - "user_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -7526,15 +11375,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "created_at", - "user_id", - "operation_type", - "user", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action" + "created_at", + "operation_type" ] }, { @@ -7542,13 +11406,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "_document_id", - "created_at", - "user_id", - "operation_type", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "action" + "user_id", + "user_agent", + "created_at", + "operation_type" ] }, { @@ -7556,17 +11437,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", - "operation_type", - "action", - "_document_id" + "created_at", + "operation_type" ] }, { @@ -7574,17 +11468,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_id", - "actor", - "action", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", "operation_type", - "user", - "created_at", - "request_id", - "actor_id", - "_document_id" + "created_at" ] }, { @@ -7592,16 +11499,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user", - "operation_type", "@timestamp", - "user_agent", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", + "token_id", + "token_scopes", + "user", "user_id", - "action", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7609,15 +11530,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "user_id", - "action", "@timestamp", - "created_at", - "user_agent", - "user", "_document_id", - "request_id" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7625,18 +11561,30 @@ "description": "A secondary authentication factor was added to a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -7645,18 +11593,30 @@ "description": "Two-factor authentication was disabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", "fields": [ - "actor", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor_id", + "user_agent", "created_at", - "operation_type", - "request_id", - "@timestamp", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Disabling two-factor authentication for your personal account" }, @@ -7665,18 +11625,30 @@ "description": "Two-factor authentication was enabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ - "actor", - "operation_type", - "user_agent", + "@timestamp", + "_document_id", "action", - "created_at", + "actor", "actor_id", - "@timestamp", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ], "docs_reference_titles": "Configuring two-factor authentication" }, @@ -7685,15 +11657,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user", - "user_id", - "action", "@timestamp", - "request_id", "_document_id", - "user_agent" + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7701,36 +11688,61 @@ "description": "Two factor recovery codes were regenerated for a user account.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "operation_type", + "@timestamp", "_document_id", - "user_id", "action", - "user", - "user_agent", - "actor_id", - "@timestamp", - "created_at" - ] - }, - { - "action": "two_factor_authentication.remove_factor", - "description": "A secondary authentication factor was removed from a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", - "fields": [ "actor", "actor_id", - "user_agent", - "request_id", - "user", - "user_id", - "action", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "two_factor_authentication.remove_factor", + "description": "A secondary authentication factor was removed from a user account.", + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, @@ -7739,15 +11751,30 @@ "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "operation_type", - "user_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", - "created_at", - "_document_id", - "action", - "@timestamp" + "operation_type", + "created_at" ] }, { @@ -7756,16 +11783,29 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "created_at", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "operation_type", "user_agent", - "action", - "request_id", - "actor", - "actor_id" + "created_at", + "operation_type" ] }, { @@ -7773,19 +11813,31 @@ "description": "An email address was added to a user account.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", "fields": [ + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", "user_agent", "operation_type", - "_document_id", - "actor_id", - "actor", "email", - "@timestamp", - "created_at", - "request_access_security_header" + "created_at" ], "docs_reference_titles": "Adding an email address to your GitHub account" }, @@ -7794,18 +11846,30 @@ "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", "docs_reference_links": "N/A", "fields": [ - "actor", - "user_id", - "created_at", - "user", "@timestamp", "_document_id", - "request_id", + "action", + "actor", "actor_id", - "operation_type", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "action", - "request_access_security_header" + "created_at", + "operation_type" ] }, { @@ -7813,15 +11877,28 @@ "description": "Audit log entries were exported.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user", - "action", - "request_id", - "actor", "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "operation_type", "created_at" ] @@ -7831,20 +11908,31 @@ "description": "A user was blocked by another user.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", "action", "actor", - "user_id", - "_document_id", "actor_id", - "@timestamp", - "user_agent", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "created_at", - "programmatic_access_type", - "request_access_security_header" + "created_at" ] }, { @@ -7852,18 +11940,30 @@ "description": "A user changed their password.", "docs_reference_links": "N/A", "fields": [ - "request_id", "@timestamp", - "user_agent", - "actor_id", - "operation_type", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "created_at", - "_document_id", - "request_access_security_header" + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7871,18 +11971,30 @@ "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id", - "programmatic_access_type" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -7891,17 +12003,30 @@ "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ - "user_agent", - "request_id", - "actor", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, @@ -7910,19 +12035,31 @@ "description": "A new user account was created.", "docs_reference_links": "N/A", "fields": [ - "email", - "user_id", - "operation_type", "@timestamp", - "request_id", - "user", - "created_at", "_document_id", - "user_agent", + "action", "actor", "actor_id", - "action", - "programmatic_access_type" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "email", + "operation_type", + "created_at" ] }, { @@ -7930,21 +12067,33 @@ "description": "A user secret for Codespaces was created.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -7952,20 +12101,31 @@ "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", "docs_reference_links": "N/A", "fields": [ - "user", - "created_at", - "user_agent", + "@timestamp", "_document_id", - "operation_type", - "oauth_application_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "user_id", - "@timestamp", + "token_id", "token_scopes", - "programmatic_access_type" + "user", + "user_id", + "user_agent", + "created_at", + "operation_type", + "oauth_application_id" ] }, { @@ -7973,18 +12133,30 @@ "description": "A user account was destroyed by an asynchronous job.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "user_agent", + "@timestamp", + "_document_id", "action", - "request_id", - "user_id", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "_document_id", - "request_access_security_header" + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -7993,19 +12165,30 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "oauth_application_id", + "_document_id", "action", - "user", - "created_at", - "user_agent", - "request_id", "actor", "actor_id", - "operation_type", - "_document_id", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "created_at", + "operation_type" ] }, { @@ -8013,18 +12196,30 @@ "description": "A user deleted his or her account, triggering user.async_delete.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "_document_id", - "created_at", - "user_agent", "user_id", - "operation_type", - "actor_id", - "action", - "@timestamp", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8032,18 +12227,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "user_agent", "user_id", - "actor_id", - "action", - "operation_type", - "request_access_security_header" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8051,18 +12258,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "operation_type", - "created_at", - "_document_id", - "@timestamp", - "user", - "actor_id", - "action", - "request_access_security_header" + "created_at" ] }, { @@ -8071,35 +12290,60 @@ "docs_reference_links": "N/A", "fields": [ "@timestamp", - "user", "_document_id", "action", - "operation_type", - "user_agent", - "created_at", - "request_id", "actor", "actor_id", - "user_id", - "request_access_security_header" - ] - }, - { - "action": "user.disable_collaborators_only", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, + { + "action": "user.disable_collaborators_only", "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8107,17 +12351,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8125,17 +12382,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8143,21 +12413,31 @@ "description": "An enterprise managed user claimed an email address.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -8165,21 +12445,31 @@ "description": "N/A", "docs_reference_links": "An enterprise managed user unclaimed an email address.", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", "operation_type", - "business", - "business_id", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ], "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." }, @@ -8188,17 +12478,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8206,17 +12509,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8224,17 +12540,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", + "user_agent", "operation_type", - "@timestamp", - "created_at", - "_document_id" + "created_at" ] }, { @@ -8242,18 +12571,30 @@ "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "action", - "operation_type", - "request_id", - "created_at", - "_document_id", "@timestamp", - "user", - "org_id", + "_document_id", + "action", "actor", "actor_id", - "user_agent" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8261,18 +12602,32 @@ "description": "A user requested a password reset.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", "fields": [ - "action", - "_document_id", - "user_agent", - "request_id", - "user", - "operation_type", "@timestamp", - "email", - "created_at", - "user_id", - "request_access_security_header" - ], + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "email", + "created_at" + ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" }, { @@ -8280,17 +12635,30 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "action", - "created_at", - "user_agent", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "actor", - "operation_type", - "request_id" + "user_agent", + "created_at", + "operation_type" ] }, { @@ -8298,18 +12666,30 @@ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -8318,19 +12698,31 @@ "description": "A user signed in.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user_id", - "actor_id", "@timestamp", - "user", - "action", - "operation_type", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", "created_at", - "actor", - "passkey_nickname", - "request_access_security_header" + "passkey_nickname" ] }, { @@ -8338,18 +12730,30 @@ "description": "A user signed out.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8357,18 +12761,30 @@ "description": "A user signed in from a new device.", "docs_reference_links": "N/A", "fields": [ - "user", - "user_id", - "actor", - "operation_type", - "created_at", - "user_agent", - "actor_id", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8376,21 +12792,31 @@ "description": "An ordinary user account was promoted to a site administrator.", "docs_reference_links": "N/A", "fields": [ - "user_id", + "@timestamp", + "_document_id", "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "@timestamp", - "created_at", + "user_id", "user_agent", + "created_at", "oauth_application_id", - "request_id", - "operation_type", - "_document_id", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8398,16 +12824,29 @@ "description": "A user's account was restored.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "user", - "action", - "actor_id", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "actor", "operation_type" ] }, @@ -8416,20 +12855,31 @@ "description": "An email address was removed from a user account.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "action", "@timestamp", "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "actor", - "actor_id", "created_at", - "email", - "token_scopes", - "programmatic_access_type" + "email" ] }, { @@ -8437,20 +12887,32 @@ "description": "A user secret for Codespaces was deleted.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "key", - "integration", + "token_id", + "token_scopes", "user", "user_id", - "action", - "_document_id", - "@timestamp", + "user_agent", + "key", + "integration", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8458,20 +12920,31 @@ "description": "A username was changed.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "request_id", - "actor_id", - "old_login", - "created_at", + "@timestamp", "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "@timestamp", - "operation_type", "user_agent", - "token_scopes", - "programmatic_access_type" + "old_login", + "created_at", + "operation_type" ] }, { @@ -8479,18 +12952,30 @@ "description": "A user reset their account password.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", - "user", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", "user_id", + "user_agent", "created_at", - "@timestamp", - "_document_id", - "actor", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8498,16 +12983,29 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "created_at", - "request_id", - "user_id", - "action", "@timestamp", "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", + "user_id", "user_agent", + "created_at", "operation_type" ] }, @@ -8518,16 +13016,28 @@ "fields": [ "@timestamp", "_document_id", - "request_id", - "user_id", "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "operation_type", + "user_id", "user_agent", - "actor_id", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, @@ -8536,18 +13046,30 @@ "description": "A user signed in from an unrecognized device.", "docs_reference_links": "N/A", "fields": [ - "request_id", - "action", + "@timestamp", "_document_id", - "user_agent", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", + "user_agent", "operation_type", - "created_at", - "actor", - "actor_id", - "@timestamp", - "request_access_security_header" + "created_at" ] }, { @@ -8555,18 +13077,30 @@ "description": "A user signed in from an unrecognized device and location.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "@timestamp", "user_agent", "created_at", - "_document_id", - "request_id", - "action", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8574,22 +13108,33 @@ "description": "Triggered when you clear the status on your profile.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "actor", + "user_agent", "message", - "user", - "actor_id", "created_at", - "request_id", "limited_availability", - "action", "emoji", - "operation_type", - "user_agent", - "@timestamp", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -8597,23 +13142,33 @@ "description": "Triggered when you set or change the status on your profile.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", "fields": [ - "limited_availability", - "user", + "@timestamp", + "_document_id", "action", + "actor", "actor_id", - "message", - "user_id", - "created_at", - "_document_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "@timestamp", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", + "limited_availability", + "message", + "created_at", "emoji", - "org", - "actor", - "operation_type", - "token_scopes", - "programmatic_access_type" + "operation_type" ], "docs_reference_titles": "Personalize your profile" }, @@ -8622,21 +13177,31 @@ "description": "A user account was suspended.", "docs_reference_links": "N/A", "fields": [ - "oauth_application_id", - "operation_type", - "actor_id", - "user", - "user_agent", - "request_id", - "actor", - "created_at", - "_document_id", "@timestamp", - "user_id", + "_document_id", "action", - "token_scopes", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -8644,37 +13209,61 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "request_id", - "user", - "actor_id", "@timestamp", - "operation_type", "_document_id", - "user_agent", - "actor", "action", - "user_id", - "created_at", - "request_access_security_header" - ] - }, + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" + ] + }, { "action": "user.two_factor_challenge_failure", "description": "A 2FA challenge issued for a user account failed.", "docs_reference_links": "N/A", "fields": [ - "operation_type", - "created_at", - "_document_id", - "user_agent", - "user", - "actor_id", - "actor", - "user_id", "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "request_access_security_header" + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8684,16 +13273,28 @@ "fields": [ "@timestamp", "_document_id", - "user_id", - "operation_type", + "action", + "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", - "actor", + "user_id", "user_agent", - "request_id", - "action", - "created_at", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8701,18 +13302,30 @@ "description": "A user used their 2FA recovery codes.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", - "user_agent", - "request_id", - "user", + "@timestamp", + "_document_id", "action", "actor", "actor_id", - "created_at", - "@timestamp", - "_document_id", - "request_access_security_header" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8720,18 +13333,30 @@ "description": "A user downloaded 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user_id", - "operation_type", + "@timestamp", + "_document_id", + "action", + "actor", "actor_id", - "user", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "action", - "@timestamp", - "created_at", + "token_id", + "token_scopes", + "user", + "user_id", "user_agent", - "actor", - "_document_id", - "request_access_security_header" + "operation_type", + "created_at" ] }, { @@ -8739,17 +13364,30 @@ "description": "A user printed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "user", - "action", - "operation_type", - "user_agent", - "request_id", - "user_id", - "created_at", + "@timestamp", "_document_id", + "action", "actor", "actor_id", - "@timestamp" + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "operation_type", + "created_at" ] }, { @@ -8757,18 +13395,30 @@ "description": "A user viewed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ - "actor_id", - "user_agent", + "@timestamp", + "_document_id", + "action", "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", "user_id", - "action", + "user_agent", "created_at", - "user", - "operation_type", - "@timestamp", - "request_id", - "_document_id", - "request_access_security_header" + "operation_type" ] }, { @@ -8776,17 +13426,30 @@ "description": "A user was prompted for a two-factor authentication code.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", "fields": [ - "user", - "actor_id", + "@timestamp", + "_document_id", "action", - "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "created_at", - "_document_id", + "token_id", + "token_scopes", + "user", "user_id", - "operation_type", - "@timestamp", - "actor" + "user_agent", + "created_at", + "operation_type" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" }, @@ -8795,19 +13458,31 @@ "description": "A user was unblocked by another user.", "docs_reference_links": "N/A", "fields": [ - "actor_id", + "@timestamp", + "_document_id", "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", - "_document_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "blocked_user", "operation_type", - "actor", - "@timestamp", - "user_agent", - "user_id", - "user", - "created_at", - "request_access_security_header" + "created_at" ] }, { @@ -8815,21 +13490,31 @@ "description": "A user account was unsuspended.", "docs_reference_links": "N/A", "fields": [ - "request_id", + "@timestamp", "_document_id", - "user", "action", - "user_agent", "actor", - "oauth_application_id", - "operation_type", "actor_id", - "created_at", - "@timestamp", - "user_id", - "token_scopes", + "business", + "business_id", + "hashed_token", + "org", + "org_id", "programmatic_access_type", - "request_access_security_header" + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "oauth_application_id", + "operation_type", + "created_at" ] }, { @@ -8837,21 +13522,33 @@ "description": "A user secret for Codespaces was updated.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "key", "visibility", "integration", - "user", - "user_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8859,46 +13556,64 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "created_at", + "operation_type" + ] + }, + { + "action": "workflows.approve_workflow_job", + "description": "A workflow job was approved.", + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", "user", "user_id", - "action", - "operation_type", - "@timestamp", - "_document_id", - "request_access_security_header" - ] - }, - { - "action": "workflows.approve_workflow_job", - "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", - "fields": [ "user_agent", - "request_id", - "actor", - "actor_id", "workflow_run_id", "run_number", - "user", - "user_id", - "repo", - "repo_id", - "business", - "business_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "token_scopes", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -8907,23 +13622,33 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_id", + "request_access_security_header", "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_run_id", "run_number", - "repo", - "repo_id", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", - "operation_type", - "request_access_security_header" + "operation_type" ] }, { @@ -8931,23 +13656,31 @@ "description": "N/A", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", - "token_id", - "hashed_token", - "programmatic_access_type", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "public_repo", - "org", - "org_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type" ] @@ -8957,23 +13690,35 @@ "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "operation_type", - "@timestamp", "created_at", - "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", - "trigger_id", - "programmatic_access_type" + "trigger_id" ], "docs_reference_titles": "Deleting a workflow run" }, @@ -8982,22 +13727,33 @@ "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", "public_repo", - "programmatic_access_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9005,21 +13761,32 @@ "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "workflow_id", - "action", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ] }, { @@ -9027,25 +13794,33 @@ "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] }, { @@ -9053,24 +13828,33 @@ "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ - "user_agent", - "request_id", + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "workflow_run_id", - "run_number", - "user", - "user_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", - "action", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", + "workflow_run_id", + "run_number", "operation_type", - "@timestamp", "created_at", - "_document_id", - "public_repo", - "programmatic_access_type", - "request_access_security_header" + "public_repo" ], "docs_reference_titles": "Reviewing deployments" }, @@ -9079,25 +13863,33 @@ "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ + "@timestamp", + "_document_id", + "action", "actor", "actor_id", - "user_agent", - "request_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", "repo", "repo_id", + "repository", + "repository_id", + "request_access_security_header", + "request_id", + "token_id", + "token_scopes", + "user", + "user_id", + "user_agent", "public_repo", "workflow_id", - "org", - "org_id", - "business", - "business_id", - "action", - "_document_id", - "@timestamp", "created_at", "operation_type", - "actor_is_bot", - "request_access_security_header" + "actor_is_bot" ] } ] \ No newline at end of file diff --git a/src/audit-logs/lib/index.ts b/src/audit-logs/lib/index.ts index 8538890f844f..a9f47194ca9a 100644 --- a/src/audit-logs/lib/index.ts +++ b/src/audit-logs/lib/index.ts @@ -209,12 +209,14 @@ export async function filterByAllowlistValues({ currentEvents = [], pipelineConfig, titleContext, + globalFields = [], }: { eventsToCheck: RawAuditLogEventT[] allowListValues: string | string[] currentEvents?: AuditLogEventT[] pipelineConfig: PipelineConfig titleContext?: TitleResolutionContext + globalFields?: string[] }) { if (!Array.isArray(allowListValues)) allowListValues = [allowListValues] if (!currentEvents) currentEvents = [] @@ -230,11 +232,18 @@ export async function filterByAllowlistValues({ if (seen.has(event.action)) continue seen.add(event.action) + // Merge global fields with event-specific fields + const mergedFields = event.fields + ? [...new Set([...globalFields, ...event.fields])] + : globalFields.length > 0 + ? [...globalFields] + : undefined + const minimal: AuditLogEventT = { action: event.action, description: processAndGetEventDescription(event, eventAllowlists, pipelineConfig), docs_reference_links: event.docs_reference_links, - fields: event.fields, + fields: mergedFields, } // Resolve reference link titles if context is provided @@ -290,6 +299,7 @@ export async function filterAndUpdateGhesDataByAllowlistValues({ pipelineConfig, auditLogPage, titleContext, + globalFields = [], }: { eventsToCheck: RawAuditLogEventT[] allowListValue: string @@ -297,6 +307,7 @@ export async function filterAndUpdateGhesDataByAllowlistValues({ pipelineConfig: PipelineConfig auditLogPage: string titleContext?: TitleResolutionContext + globalFields?: string[] }) { if (!currentGhesEvents) currentGhesEvents = {} @@ -316,11 +327,21 @@ export async function filterAndUpdateGhesDataByAllowlistValues({ if (seenByGhesVersion.get(fullGhesVersion)?.has(event.action)) continue if (ghesVersionAllowlists.includes(allowListValue)) { + // Get event-specific fields (prefer GHES version fields, fall back to base fields) + const eventFields = event.ghes[ghesVersion].fields || event.fields + + // Merge global fields with event-specific fields + const mergedFields = eventFields + ? [...new Set([...globalFields, ...eventFields])] + : globalFields.length > 0 + ? [...globalFields] + : undefined + const minimal: AuditLogEventT = { action: event.action, description: processAndGetEventDescription(event, ghesVersionAllowlists, pipelineConfig), docs_reference_links: event.docs_reference_links, - fields: event.ghes[ghesVersion].fields || event.fields, + fields: mergedFields, } // Resolve reference link titles if context is provided diff --git a/src/audit-logs/scripts/sync.ts b/src/audit-logs/scripts/sync.ts index a1ebc977230f..9be6dd6c2358 100755 --- a/src/audit-logs/scripts/sync.ts +++ b/src/audit-logs/scripts/sync.ts @@ -50,6 +50,22 @@ async function main() { const schemaEvents = JSON.parse(await getContents(owner, repo, ref, schemaFilePath)) const mainSha = await getCommitSha(owner, repo, `heads/${ref}`) + // Fetch fields.json to get global fields that should be included in all events + const fieldsFilePath = 'allowlists/fields.json' + const fieldsData = JSON.parse(await getContents(owner, repo, ref, fieldsFilePath)) + + // Extract global fields (excluding those gated by feature flags) + if (!fieldsData.global?.include) { + console.warn('Warning: fieldsData.global.include not found, no global fields will be added') + } + type FieldsIncludeEntry = { fields: string[]; feature_flag?: string } + const globalFields: string[] = + fieldsData.global?.include + ?.filter((entry: FieldsIncludeEntry) => !entry.feature_flag) + ?.flatMap((entry: FieldsIncludeEntry) => entry.fields) || [] + + console.log(`Loaded ${globalFields.length} global fields from fields.json`) + const configFilepath = `src/audit-logs/lib/config.json` const pipelineConfig = JSON.parse(await readFile(configFilepath, 'utf8')) pipelineConfig.sha = mainSha @@ -90,6 +106,7 @@ async function main() { currentEvents, pipelineConfig, titleContext, + globalFields, }) // Wrapper around filterGhesByAllowlistValues() because we always need all the // schema events and pipeline config data. @@ -105,6 +122,7 @@ async function main() { pipelineConfig, auditLogPage, titleContext, + globalFields, }) auditLogData.fpt = {} diff --git a/src/audit-logs/tests/unit/filter-events.ts b/src/audit-logs/tests/unit/filter-events.ts index 84064ac08091..8448289abd53 100644 --- a/src/audit-logs/tests/unit/filter-events.ts +++ b/src/audit-logs/tests/unit/filter-events.ts @@ -81,6 +81,99 @@ describe('audit log event filtering', () => { expect(filteredEvents.length).toBe(0) }) + test('merges global fields with event-specific fields', async () => { + const eventsToProcess: RawAuditLogEventT[] = [ + { + action: 'repo.create', + _allowlists: ['user'], + description: 'repo was created', + docs_reference_links: '', + ghes: {}, + fields: ['repo', 'repo_id'], + }, + ] + + const filteredEvents = await filterByAllowlistValues({ + eventsToCheck: eventsToProcess, + allowListValues: 'user', + currentEvents: [], + pipelineConfig: { sha: '', appendedDescriptions: {} }, + globalFields: ['@timestamp', 'action'], + }) + expect(filteredEvents[0].fields).toEqual( + expect.arrayContaining(['@timestamp', 'action', 'repo', 'repo_id']), + ) + expect(filteredEvents[0].fields?.length).toBe(4) + }) + + test('deduplicates global fields already present in event fields', async () => { + const eventsToProcess: RawAuditLogEventT[] = [ + { + action: 'repo.create', + _allowlists: ['user'], + description: 'repo was created', + docs_reference_links: '', + ghes: {}, + fields: ['action', 'repo'], + }, + ] + + const filteredEvents = await filterByAllowlistValues({ + eventsToCheck: eventsToProcess, + allowListValues: 'user', + currentEvents: [], + pipelineConfig: { sha: '', appendedDescriptions: {} }, + globalFields: ['@timestamp', 'action'], + }) + expect(filteredEvents[0].fields).toEqual( + expect.arrayContaining(['@timestamp', 'action', 'repo']), + ) + expect(filteredEvents[0].fields?.length).toBe(3) + }) + + test('uses only global fields when event has no fields', async () => { + const eventsToProcess: RawAuditLogEventT[] = [ + { + action: 'code_scanning.alert_created', + _allowlists: ['user'], + description: 'alert was created', + docs_reference_links: '', + ghes: {}, + }, + ] + + const filteredEvents = await filterByAllowlistValues({ + eventsToCheck: eventsToProcess, + allowListValues: 'user', + currentEvents: [], + pipelineConfig: { sha: '', appendedDescriptions: {} }, + globalFields: ['@timestamp', 'action'], + }) + expect(filteredEvents[0].fields).toEqual(['@timestamp', 'action']) + }) + + test('handles empty globalFields array', async () => { + const eventsToProcess: RawAuditLogEventT[] = [ + { + action: 'repo.create', + _allowlists: ['user'], + description: 'repo was created', + docs_reference_links: '', + ghes: {}, + fields: ['repo', 'repo_id'], + }, + ] + + const filteredEvents = await filterByAllowlistValues({ + eventsToCheck: eventsToProcess, + allowListValues: 'user', + currentEvents: [], + pipelineConfig: { sha: '', appendedDescriptions: {} }, + globalFields: [], + }) + expect(filteredEvents[0].fields).toEqual(['repo', 'repo_id']) + }) + test('ghes filters and updates multiple ghes versions', async () => { const eventsToProcess: RawAuditLogEventT[] = [ { From 5433f3d3653cf2ee497f65b7954196974d324472 Mon Sep 17 00:00:00 2001 From: Claire W <78226508+crwaters16@users.noreply.github.com> Date: Mon, 9 Feb 2026 12:43:53 -0600 Subject: [PATCH 3/4] Tented model release 0021 (#59565) Co-authored-by: sunbrye --- content/copilot/reference/ai-models/model-hosting.md | 1 + data/tables/copilot/model-multipliers.yml | 4 ++++ data/tables/copilot/model-release-status.yml | 7 +++++++ data/tables/copilot/model-supported-clients.yml | 8 ++++++++ data/tables/copilot/model-supported-plans.yml | 7 +++++++ data/variables/copilot.yml | 1 + 6 files changed, 28 insertions(+) diff --git a/content/copilot/reference/ai-models/model-hosting.md b/content/copilot/reference/ai-models/model-hosting.md index 104109a9241e..84c40c3c5a73 100644 --- a/content/copilot/reference/ai-models/model-hosting.md +++ b/content/copilot/reference/ai-models/model-hosting.md @@ -30,6 +30,7 @@ Used for: * {% data variables.copilot.copilot_gpt_51_codex_max %} * {% data variables.copilot.copilot_gpt_52 %} * {% data variables.copilot.copilot_gpt_52_codex %} +* {% data variables.copilot.copilot_gpt_53_codex %} These models are hosted by OpenAI and {% data variables.product.github %}'s Azure infrastructure. diff --git a/data/tables/copilot/model-multipliers.yml b/data/tables/copilot/model-multipliers.yml index f343ef8832e5..4283c91a8f53 100644 --- a/data/tables/copilot/model-multipliers.yml +++ b/data/tables/copilot/model-multipliers.yml @@ -93,6 +93,10 @@ multiplier_paid: 1.0 multiplier_free: Not applicable +- name: GPT-5.3-Codex + multiplier_paid: 1.0 + multiplier_free: Not applicable + - name: Grok Code Fast 1 multiplier_paid: 0.25 multiplier_free: Not applicable diff --git a/data/tables/copilot/model-release-status.yml b/data/tables/copilot/model-release-status.yml index 7abda6063bfe..d80e799a53ee 100644 --- a/data/tables/copilot/model-release-status.yml +++ b/data/tables/copilot/model-release-status.yml @@ -88,6 +88,13 @@ ask_mode: true edit_mode: true +- name: 'GPT-5.3-Codex' + provider: 'OpenAI' + release_status: 'GA' + agent_mode: true + ask_mode: true + edit_mode: true + # Anthropic models - name: 'Claude Haiku 4.5' provider: 'Anthropic' diff --git a/data/tables/copilot/model-supported-clients.yml b/data/tables/copilot/model-supported-clients.yml index cbe3cf27b5d4..39425fc65a6e 100644 --- a/data/tables/copilot/model-supported-clients.yml +++ b/data/tables/copilot/model-supported-clients.yml @@ -173,6 +173,14 @@ xcode: true jetbrains: true +- name: GPT-5.3-Codex + dotcom: true + vscode: true + vs: false + eclipse: false + xcode: false + jetbrains: false + - name: Grok Code Fast 1 dotcom: true vscode: true diff --git a/data/tables/copilot/model-supported-plans.yml b/data/tables/copilot/model-supported-plans.yml index a46efa756c6e..508b90d14d35 100644 --- a/data/tables/copilot/model-supported-plans.yml +++ b/data/tables/copilot/model-supported-plans.yml @@ -152,6 +152,13 @@ business: true enterprise: true +- name: GPT-5.3-Codex + free: false + pro: true + pro_plus: true + business: true + enterprise: true + - name: Grok Code Fast 1 free: false pro: true diff --git a/data/variables/copilot.yml b/data/variables/copilot.yml index 7e788f9ded38..f3b85b721d02 100644 --- a/data/variables/copilot.yml +++ b/data/variables/copilot.yml @@ -166,6 +166,7 @@ copilot_gpt_51_codex_mini: 'GPT-5.1-Codex-Mini' copilot_gpt_51_codex_max: 'GPT-5.1-Codex-Max' copilot_gpt_52: 'GPT-5.2' copilot_gpt_52_codex: 'GPT-5.2-Codex' +copilot_gpt_53_codex: 'GPT-5.3-Codex' # OpenAI 'o' series: copilot_o3: 'o3' copilot_o4_mini: 'o4-mini' From a6472f7e4e7b8df17938b8e1d3285d6604f6a00f Mon Sep 17 00:00:00 2001 From: Rob Aiken <6567647+robaiken@users.noreply.github.com> Date: Mon, 9 Feb 2026 20:41:41 +0000 Subject: [PATCH 4/4] Add UV support and enhance Dependabot guidance (#59555) Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com> --- ...on-of-private-registries-for-dependabot.md | 39 ++++++++++++------- .../dependabot-options-reference.md | 32 +++++++++------ .../dependabot-uv-security-support.yml | 6 +++ data/features/dependabot-uv-support.yml | 6 +++ .../dependabot/supported-package-managers.md | 4 ++ 5 files changed, 61 insertions(+), 26 deletions(-) create mode 100644 data/features/dependabot-uv-security-support.yml create mode 100644 data/features/dependabot-uv-support.yml diff --git a/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/guidance-for-the-configuration-of-private-registries-for-dependabot.md b/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/guidance-for-the-configuration-of-private-registries-for-dependabot.md index d77b65a1157d..3d147331f6a9 100644 --- a/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/guidance-for-the-configuration-of-private-registries-for-dependabot.md +++ b/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/guidance-for-the-configuration-of-private-registries-for-dependabot.md @@ -41,7 +41,8 @@ You'll find detailed guidance for the setup of the following package managers: * [npm](#npm) * [NuGet](#nuget) * [pub](#pub) -* [Python](#python) +* [Python](#python) (includes pip, pip-compile, pipenv, and poetry){% ifversion dependabot-uv-support %} +* [uv](#uv){% endif %} * [Yarn](#yarn) You'll also find recommendations for the setup of the following registry hosts: @@ -69,7 +70,7 @@ Bun adheres to the same configuration guidelines as npm. Note that the `.npmrc` Supported by Artifactory, Artifacts, Cloudsmith, {% data variables.product.prodname_registry %} registry, Nexus, and ProGet. -You can authenticate with either a username and password, or a token. For more information, see `rubygems-server` in [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#rubygems-server). +You can authenticate with either a username and password, or a token. For more information, see `rubygems-server` in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#rubygems-server). Snippet of a `dependabot.yml` file using a username and password. @@ -106,7 +107,7 @@ registries: ### Cargo -Cargo supports username, password and token-based authentication. For more information, see `cargo-registry` in [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#cargo-registry). +Cargo supports username, password and token-based authentication. For more information, see `cargo-registry` in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#cargo-registry). The snippet below shows a `dependabot.yml` file configuration that uses a token. @@ -114,7 +115,7 @@ The snippet below shows a `dependabot.yml` file configuration that uses a token. ### Docker -Docker supports using a username and password for registries. For more information, see `docker-registry` in [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#docker-registry). +Docker supports using a username and password for registries. For more information, see `docker-registry` in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#docker-registry). Snippet of `dependabot.yml` file using a username and password. @@ -171,7 +172,7 @@ Docker Compose adheres to the same configuration guidelines as Docker. For more ### Helm Charts -Helm supports using a username and password for registries. For more information, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#helm-registry). +Helm supports using a username and password for registries. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#helm-registry). Snippet of `dependabot.yml` file using a username and password. @@ -209,7 +210,7 @@ When configuring {% data variables.product.prodname_dependabot %} for Helm chart {% data variables.product.prodname_dependabot %} doesn't run Gradle but supports updates to certain Gradle files. For more information, see "Gradle" in [AUTOTITLE](/code-security/dependabot/ecosystems-supported-by-dependabot/supported-ecosystems-and-repositories#gradle). -Gradle supports the `maven-repository` registry type. For more information, see `maven-repository` in [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#maven-repository). +Gradle supports the `maven-repository` registry type. For more information, see `maven-repository` in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#maven-repository). The `maven-repository` type supports username, password and replaces-base. {% data reusables.dependabot.password-definition %} @@ -281,7 +282,7 @@ This feature enables unified dependency management for both public and private G ### Maven -Maven supports username, password and replaces-base. For more information, see `maven-repository` in [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#maven-repository). +Maven supports username, password and replaces-base. For more information, see `maven-repository` in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#maven-repository). {% raw %} @@ -331,7 +332,7 @@ You can define the configuration in the `dependabot.yml` file using the `npm-reg #### Using the `npm-registry` type in the configuration file -You can define the private registry configuration in a `dependabot.yml` file using the `npm-registry` type. For more information, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#npm-registry). +You can define the private registry configuration in a `dependabot.yml` file using the `npm-registry` type. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#npm-registry). The snippet of a `dependabot.yml` file below uses a token. {% data reusables.dependabot.token-is-github-pat %} @@ -412,7 +413,7 @@ If you use a monorepo, the `.npmrc` file should live in the project's root direc You can configure {% data variables.product.prodname_dependabot %} to send all registry requests through a specified base URL. In order for {% data variables.product.prodname_dependabot %} to access a public dependency, the registry must either have a cloned copy of the dependency with the requested version, or allow traffic to fetch from a public registry if the dependency is not available. -If there is no global registry defined in a `.npmrc` file, you can set `replaces-base` to `true` in the `dependabot.yml` file. For more information, see "`replaces-base`" in [Top-level `registries` key](/code-security/dependabot/working-with-dependabot/dependabot-options-reference#top-level-registries-key). +If there is no global registry defined in a `.npmrc` file, you can set `replaces-base` to `true` in the `dependabot.yml` file. For more information, see "`replaces-base`" in [Top-level `registries` key](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/dependabot-options-reference#top-level-registries-key). #### Notes @@ -426,7 +427,7 @@ Registries should be configured using the `https` protocol. Supported by Artifactory, Artifacts, Cloudsmith, {% data variables.product.prodname_registry %} registry, Nexus, and ProGet. -The `nuget-feed` type supports username and password, or token. For more information, see `nuget-feed` in [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#nuget-feed). +The `nuget-feed` type supports username and password, or token. For more information, see `nuget-feed` in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#nuget-feed). {% raw %} @@ -472,7 +473,7 @@ registries: ### pub -You can define the private registry configuration in a `dependabot.yml` file using the `pub-repository` type. For more information, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#pub-repository). +You can define the private registry configuration in a `dependabot.yml` file using the `pub-repository` type. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#pub-repository). {% raw %} @@ -505,7 +506,7 @@ pub supports URL and token authentication. The URL used for the registry should Supported by Artifactory, Azure Artifacts, Cloudsmith, Nexus, and ProGet. The {% data variables.product.prodname_registry %} registry is not supported. -The `python-index` type supports username and password, or token. For more information, see `python-index` in [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#python-index). +The `python-index` type supports username and password, or token. For more information, see `python-index` in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#python-index). {% raw %} @@ -550,9 +551,17 @@ registries: `url` should contain the URL, organization, and the "feed" or repository. +{% ifversion dependabot-uv-support %} + +### uv + +The uv registry uses a configuration similar to that of the python index. For more information, see "`python-index`" in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#python-index). + +{% endif %} + ### Yarn -The Yarn registry uses a configuration similar to that of the npm registry. For more information, see "`npm-registry`" in [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#npm-registry). +The Yarn registry uses a configuration similar to that of the npm registry. For more information, see "`npm-registry`" in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#npm-registry). {% raw %} @@ -576,7 +585,7 @@ You can either specify the private registry configuration in the `dependabot.yml ##### Defining the private registry configuration in the `dependabot.yml` file -You can define the private registry configuration in your `dependabot.yml` file. For more information, see [Top-level `registries` key](/code-security/dependabot/working-with-dependabot/dependabot-options-reference#top-level-registries-key). +You can define the private registry configuration in your `dependabot.yml` file. For more information, see [Top-level `registries` key](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/dependabot-options-reference#top-level-registries-key). To ensure that the private registry is listed as the dependency source in the project's `yarn.lock` file, you need to run `yarn install` on a machine with private registry access. Yarn should update the resolved field to include the private registry URL. @@ -613,7 +622,7 @@ As with Yarn Classic, you can either specify the private registry configuration ##### Defining the private registry configuration in the `dependabot.yml` file -You can define the private registry configuration in your `dependabot.yml` file. For more information, see [Top-level `registries` key](/code-security/dependabot/working-with-dependabot/dependabot-options-reference#top-level-registries-key). +You can define the private registry configuration in your `dependabot.yml` file. For more information, see [Top-level `registries` key](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/dependabot-options-reference#top-level-registries-key). To ensure the private registry is listed as the dependency source in the project's `yarn.lock` file, run `yarn install` on a machine with private registry access. Yarn should update the resolved field to include the private registry URL. diff --git a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md index fc407ab67954..49d4a24ff91a 100644 --- a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md +++ b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md @@ -100,10 +100,10 @@ For most package managers, you should define a value that will match the depende | Dependency types | Supported by package managers | Allow updates | |------------------|-------------------------------|--------| | `direct` | All | All explicitly defined dependencies. | -| `indirect` | `bundler`, `pip`, `composer`, `cargo`, `gomod` | Dependencies of direct dependencies (also known as sub-dependencies, or transitive dependencies).| -| `all` | All | All explicitly defined dependencies. For `bundler`, `pip`, `composer`, `cargo`, `gomod`, also the dependencies of direct dependencies.| -| `production` | `bundler`, `composer`, `mix`, `maven`, `npm`, `pip` (not all managers) | Only to dependencies defined by the package manager as production dependencies. | -| `development`| `bundler`, `composer`, `mix`, `maven`, `npm`, `pip` (not all managers) | Only to dependencies defined by the package manager as development dependencies. | +| `indirect` | `bundler`, `pip`, `composer`, `cargo`, `gomod`{% ifversion dependabot-uv-support %}, `uv`{% endif %} | Dependencies of direct dependencies (also known as sub-dependencies, or transitive dependencies).| +| `all` | All | All explicitly defined dependencies. For `bundler`, `pip`, `composer`, `cargo`, `gomod`{% ifversion dependabot-uv-support %}, `uv`{% endif %}, also the dependencies of direct dependencies.| +| `production` | `bundler`, `composer`, `mix`, `maven`, `npm`, `pip`{% ifversion dependabot-uv-support %}, `uv`{% endif %} (not all managers) | Only to dependencies defined by the package manager as production dependencies. | +| `development`| `bundler`, `composer`, `mix`, `maven`, `npm`, `pip`{% ifversion dependabot-uv-support %}, `uv`{% endif %} (not all managers) | Only to dependencies defined by the package manager as development dependencies. | ## `assignees` {% octicon "versions" aria-label="Version updates" height="24" %} {% octicon "shield-check" aria-label="Security updates" height="24" %} @@ -151,7 +151,11 @@ When `commit-message` is defined: ### `prefix-development` +{% ifversion dependabot-uv-support %} +Supported by: `bundler`, `composer`, `mix`, `maven`, `npm`, `pip`, and `uv`. +{% else %} Supported by: `bundler`, `composer`, `mix`, `maven`, `npm`, and `pip`. +{% endif %} * Used only for commit messages that update dependencies in the Development dependency group. * Otherwise, the parameter behaves exactly as the `prefix` parameter. @@ -359,7 +363,7 @@ Specify which semantic versions (SemVer) to ignore. SemVer is an accepted standa Supported by: `bundler`, `mix`, and `pip`. -Allow {% data variables.product.prodname_dependabot %} to execute external code in the manifest during updates. For examples, see [Allowing external code execution](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#allowing-external-code-execution). +Allow {% data variables.product.prodname_dependabot %} to execute external code in the manifest during updates. For examples, see [Allowing external code execution](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#allowing-external-code-execution). {% data variables.product.prodname_dependabot %} default behavior: @@ -431,7 +435,7 @@ When `multi-ecosystem-groups` is used: Assign individual package ecosystems to a multi-ecosystem group using the `multi-ecosystem-group` parameter in your `updates` configuration. > [!IMPORTANT] -> Multi-ecosystem updates require specific configuration patterns and have unique parameter merging behavior. For complete setup instructions, configuration examples, and detailed parameter reference, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-multi-ecosystem-updates). +> Multi-ecosystem updates require specific configuration patterns and have unique parameter merging behavior. For complete setup instructions, configuration examples, and detailed parameter reference, see [AUTOTITLE](/code-security/tutorials/secure-your-dependencies/configuring-multi-ecosystem-updates). ```yaml copy # Basic `dependabot.yml` file defining a multi-ecosystem-group @@ -527,7 +531,9 @@ Package manager | YAML value | Supported versions | | {% endif %} | | Swift | `swift` | v5 | | Terraform | `terraform` | >= 0.13, <= 1.10.x | +| {% ifversion dependabot-uv-support %} | | uv | `uv` | v0 | +| {% endif %} | | {% ifversion dependabot-vcpkg-support %} | | vcpkg | `vcpkg` | Not applicable | | {% endif %} | @@ -568,11 +574,11 @@ When `rebase-strategy` is set to `disabled`, {% data variables.product.prodname_ ## `registries` {% octicon "versions" aria-label="Version updates" height="24" %} {% octicon "shield-check" aria-label="Security updates" height="24" %} -Configure access to private package registries to allow {% data variables.product.prodname_dependabot %} to update a wider range of dependencies, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot) and [AUTOTITLE](/code-security/dependabot/working-with-dependabot/guidance-for-the-configuration-of-private-registries-for-dependabot). +Configure access to private package registries to allow {% data variables.product.prodname_dependabot %} to update a wider range of dependencies, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot) and [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/guidance-for-the-configuration-of-private-registries-for-dependabot). There are 2 locations in the `dependabot.yml` file where you can use the `registries` key: -1. At the top level, where you define the private registries you want to use and their access information, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot). +1. At the top level, where you define the private registries you want to use and their access information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot). 1. Within the `updates` blocks, where you can specify which private registries each package manager should use. {% data variables.product.prodname_dependabot %} default behavior is to raise pull requests only to update dependencies stored in publicly accessible registries. @@ -806,7 +812,11 @@ Supported values: `true` or `false` ## `versioning-strategy` {% octicon "versions" aria-label="Version updates" height="24" %} {% octicon "shield-check" aria-label="Security updates" height="24" %} -Supported by: `bundler`, `cargo`, `composer`, `mix`, `npm`, `pip`, `pub` +{% ifversion dependabot-uv-support %} +Supported by: `bundler`, `cargo`, `composer`, `mix`, `npm`, `pip`, `pub`, and `uv` +{% else %} +Supported by: `bundler`, `cargo`, `composer`, `mix`, `npm`, `pip`, and `pub` +{% endif %} Define how {% data variables.product.prodname_dependabot %} should edit manifest files. For examples, see [AUTOTITLE](/code-security/dependabot/dependabot-version-updates/controlling-dependencies-updated#defining-a-versioning-strategy). @@ -945,12 +955,12 @@ The parameters used to provide authentication details for access to a private re | `rubygems-server` | `username` and `password`
or `token`
or OIDC with `tenant-id` and `client-id` | | `terraform-registry` | `token` | -All sensitive data used for authentication should be stored securely and referenced from that secure location, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot). +All sensitive data used for authentication should be stored securely and referenced from that secure location, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot). > [!TIP] > {% data reusables.dependabot.password-definition %} -For more information about OIDC support for {% data variables.product.prodname_dependabot %}, see [AUTOTITLE](/actions/concepts/security/openid-connect#oidc-support-for-dependabot) and [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#using-oidc-for-authentication). +For more information about OIDC support for {% data variables.product.prodname_dependabot %}, see [AUTOTITLE](/actions/concepts/security/openid-connect#oidc-support-for-dependabot) and [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#using-oidc-for-authentication). ### `url` and `replaces-base` diff --git a/data/features/dependabot-uv-security-support.yml b/data/features/dependabot-uv-security-support.yml new file mode 100644 index 000000000000..c5fef6d8c740 --- /dev/null +++ b/data/features/dependabot-uv-security-support.yml @@ -0,0 +1,6 @@ +# Reference: #16918 +# UV security update support for Dependabot +versions: + fpt: '*' + ghec: '*' + ghes: '> 3.20' diff --git a/data/features/dependabot-uv-support.yml b/data/features/dependabot-uv-support.yml new file mode 100644 index 000000000000..d4a02bf1e299 --- /dev/null +++ b/data/features/dependabot-uv-support.yml @@ -0,0 +1,6 @@ +# Reference: #16918 +# UV support for Dependabot +versions: + fpt: '*' + ghec: '*' + ghes: '> 3.16' diff --git a/data/reusables/dependabot/supported-package-managers.md b/data/reusables/dependabot/supported-package-managers.md index 928218f94f99..cc77bb32f64d 100644 --- a/data/reusables/dependabot/supported-package-managers.md +++ b/data/reusables/dependabot/supported-package-managers.md @@ -49,7 +49,11 @@ poetry | `pip` | v1 | {% octicon "check" aria-l | {% endif %} | [Swift](#swift) | `swift` | v5 | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} (git only) | {% octicon "x" aria-label="Not supported" %} | [Terraform](#terraform) | `terraform` | >= 0.13, <= 1.13.x | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | Not applicable | +| {% ifversion dependabot-uv-security-support %} | uv | `uv` | v0 | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | Not applicable | +| {% elsif dependabot-uv-support %} | +uv | `uv` | v0 | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | Not applicable | +| {% endif %} | | {% ifversion dependabot-vcpkg-support %} | [vcpkg](#vcpkg) | `vcpkg` | Not applicable | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | Not applicable | | {% endif %} |